1name: crowdsecurity/vpatch-CVE-2025-13956
2description: 'Detects unauthenticated access to LearnPress order statistics endpoint'
3rules:
4  - zones:
5      - URI
6    transform:
7      - urldecode
8      - lowercase
9    match:
10      type: contains
11      value: '/wp-json/lp/v1/orders/statistic'
12labels:
13  type: exploit
14  service: http
15  confidence: 3
16  spoofable: 0
17  behavior: 'http:exploit'
18  label: 'LearnPress - Missing Authorization'
19  classification:
20    - cve.CVE-2025-13956
21    - attack.T1190
22    - cwe.CWE-306
23