Nxploited

Classification basis

The primary artifact is a Python script whose main 'Upload' mode (mode 2) actively exploits the vulnerability by uploading a functional PHP web shell to a target server and verifying its accessibility, which constitutes exploitation, not just detection.

Requirements

• Target running WPL Real Estate plugin version ≤ 5.2.0 with default hardcoded I/O API keys.CVE-2026-13714.py:10-12README.md:13-15
• Target must have the I/O API enabled (enabled by default).README.md:13

Observed behavior

• Authenticates to the WPL I/O API using hardcoded public and private keys.CVE-2026-13714.py:235-239
• Uploads a PHP file (base64-decoded web shell) via a multipart POST request to the set_property endpoint.CVE-2026-13714.py:141-162CVE-2026-13714.py:227-274
• Scans predictable upload directories to locate the uploaded PHP file and verifies its presence by checking for the 'Nx-zD' signature.CVE-2026-13714.py:280-302CVE-2026-13714.py:461-463
• Logs the URL of the successfully uploaded and verified shell to a file.CVE-2026-13714.py:470

Observables

Hardcoded Credentials

Payload withheldThese are the hardcoded API keys used by the vulnerable plugin, as described in the CVE and README. They are used to authenticate to the target, not to exfiltrate data to a third party.CVE-2026-13714.py:11-12

Uploaded Payload

Payload withheldBase64-encoded PHP payload uploaded to the target. Decoded, it is a simple file upload form that echoes the signature 'Nx-zD'. It contains no backdoor, reverse shell, or data exfiltration logic.CVE-2026-13714.py:15

Network Target

Payload withheldAll HTTP requests are made to URLs derived from the user-provided target list file. There are no hardcoded external callback addresses.CVE-2026-13714.py:602-608CVE-2026-13714.py:623-632

Classification basis

The artifact is a fully functional exploit that actively forges and delivers a malicious SAMLResponse to bypass authentication and gain administrative access, then deploys a web shell for remote code execution. The README explicitly labels it a 'Proof-of-Concept Exploit' and the code contains the complete exploitation pipeline.

Requirements

• Target must be running WordPress with the miniOrange SAML SSO plugin version <= 5.4.4.CVE-2026-15981.py:30CVE-2026-15981.py:316-318
• Python 3.8+ with 'requests' and 'lxml' libraries installed.README.md:110-116

Observed behavior

• Enumerates WordPress users via REST API, author archives, and HTML patterns.CVE-2026-15981.py:193-260
• Discovers SAML Service Provider metadata (entityID, ACS URL) and IdP issuer URLs.CVE-2026-15981.py:263-377
• Constructs a SAML Assertion with an attacker-controlled NameID and a malformed signature value (e.g., 0xFF*256, ASN.1 junk) designed to cause openssl_verify() to return -1.CVE-2026-15981.py:380-488CVE-2026-15981.py:84-95
• Sends the forged SAMLResponse via HTTP POST to the ACS URL and checks for a WordPress authenticated session cookie.CVE-2026-15981.py:803-811
• Verifies admin access by checking /wp-admin/ and confirms role via users.php/plugins.php.CVE-2026-15981.py:491-517
• Uploads a PHP web shell (payload withheld) using one of four methods: plugin ZIP upload, REST API, theme/plugin editor, or media upload.CVE-2026-15981.py:542-696

Observables

Webshell

Payload withheldA PHP webshell is uploaded to the compromised WordPress target as part of the disclosed post-exploitation phase.CVE-2026-15981.py:33CVE-2026-15981.py:44-62

Exploit Behavior

Payload withheldThe script crafts malicious SAML responses to bypass authentication on the target WordPress site, which is the core of the disclosed CVE-2026-15981 exploit.CVE-2026-15981.py:421-488CVE-2026-15981.py:777-832

Target Scope

Payload withheldThe script operates exclusively on targets provided by the operator via a text file, with no hardcoded or concealed external destinations for data exfiltration.CVE-2026-15981.py:871-879CVE-2026-15981.py:888

Classification basis

The artifact is a fully functional exploit. It actively uploads malicious files to a target server and verifies code execution. The README explicitly describes it as a 'Proof-of-Concept Exploit' and the code contains logic to build and deploy a PHP webshell, then check for its successful execution.

Requirements

• Target must be running a vulnerable version of WPForms Pro (<= 1.10.1.1).CVE-2026-10818.py:298-308
• Target must have a WPForms upload form accessible on a discoverable page.CVE-2026-10818.py:344-386
• The target's /wp-content/uploads/wpforms/tmp/ directory must be writable by the web server.CVE-2026-10818.py:44-45

Observed behavior

• Discovers WPForms upload forms by crawling pages and sitemaps.CVE-2026-10818.py:311-341
• Initiates a chunked upload via the 'wpforms_upload_chunk_init' AJAX action.CVE-2026-10818.py:485-495
• Uploads a file chunk containing a polyglot PNG/PHP payload via the 'wpforms_upload_chunk' AJAX action.CVE-2026-10818.py:503-515
• Finalizes the upload via 'wpforms_file_chunks_uploaded', which assembles the file on disk before validation.CVE-2026-10818.py:529-550
• Verifies remote code execution by sending an HTTP GET request to the uploaded file and checking for a unique signature in the response.CVE-2026-10818.py:389-409
• Attempts PATH_INFO bypasses (e.g., appending '/x.php' to the URL) to trigger PHP execution on non-PHP extensions.CVE-2026-10818.py:412-420

Observables

Webshell Payload

Payload withheldThis is the expected payload for demonstrating remote code execution on a vulnerable target. It is not a backdoor; it is the exploit's intended effect.CVE-2026-10818.py:210-257

Author Contact

Payload withheldAuthor attribution in banner and README. This is standard for PoC code and does not indicate malicious intent.CVE-2026-10818.py:189README.md:224-226

Classification basis

The script actively changes user passwords on remote targets (line 186-212) and then uses the new credentials to authenticate and verify admin access (line 321-389). This goes beyond detection or scanning; it exercises the vulnerability to achieve account takeover, which is the definition of an exploit.

Requirements

• Target WordPress site must have vulnerable SignUp & SignIn or Invoice Generator plugin (<=1.0.0) installed and accessible.README.md:14-38
• Attacker must supply a list of target URLs in a file.CVE-2026-12416--CVE-2026-12417.py:456-457

Observed behavior

• Sends POST request to /wp-admin/admin-ajax.php with action=pravel_change_password or pravel_invoice_change_password, an empty reset_activation_code, and attacker-chosen new_password_custom to reset a user's password.CVE-2026-12416--CVE-2026-12417.py:186-212
• After a successful password reset, enumerates usernames via REST API and author redirects, then attempts to log in to /wp-login.php with the new password.CVE-2026-12416--CVE-2026-12417.py:280-305CVE-2026-12416--CVE-2026-12417.py:321-365
• Verifies administrator privileges by accessing /wp-admin/users.php and checking for admin-specific HTML markers.CVE-2026-12416--CVE-2026-12417.py:368-389
• Saves confirmed admin credentials (URL, username, password) to scan_results/pravel_admin_success.txt.CVE-2026-12416--CVE-2026-12417.py:152-163

Observables

Exploit Behavior

Payload withheldThis is the normal exploit behavior for the referenced CVEs and is fully documented in the README and code comments.CVE-2026-12416--CVE-2026-12417.py:186-212README.md:44-81

Hardcoded Credential

Payload withheldThe password set on compromised accounts is hardcoded and used for subsequent login verification. This is part of the exploit workflow, not a backdoor.CVE-2026-12416--CVE-2026-12417.py:34

Result Exfiltration

Payload withheldThis is the intended output of the scanner and is disclosed in the README. It does not represent covert exfiltration.CVE-2026-12416--CVE-2026-12417.py:152-163README.md:95-99

Classification basis

The artifact contains code that actively exploits CVE-2026-20182 by sending crafted network messages to bypass authentication, inject an SSH key, and establish remote access. This is confirmed by the README description and the perform_exploit_attempt function which implements the full attack chain.

Requirements

• Requires Python 3.9+ with cryptography and rich libraries, and OpenSSL 3.x/4.x shared libraries.requirements.txt:1-6README.md:97-101
• Requires a target list file with IP addresses or hostnames of vulnerable Cisco SD-WAN controllers.README.md:284-307

Observed behavior

• Establishes a DTLS connection to the target on UDP port 12346.CVE-2026-20182.py:1085-1135
• Sends a crafted CHALLENGE_ACK message as a vHub (type 2) to bypass peering authentication.CVE-2026-20182.py:1303-1304
• Completes a Hello exchange to confirm the bypass.CVE-2026-20182.py:1315-1327
• Injects an attacker-generated SSH public key via a VMANAGE_TO_PEER message.CVE-2026-20182.py:1337-1338
• Verifies SSH access as vmanage-admin on TCP port 830 (NETCONF) using the injected key.CVE-2026-20182.py:1364-1377

Observables

Ssh Key Generation And Injection

Payload withheldThis is the core exploit mechanism for CVE-2026-20182, enabling unauthorized SSH access to the target device. It is not a backdoor against the operator.CVE-2026-20182.py:337-338CVE-2026-20182.py:758-777

Ssh Verification

Payload withheldThis verifies the exploit's success against the target, not against the operator's machine.CVE-2026-20182.py:809-895

Output Files

Payload withheldThese are standard output artifacts for an assessment tool. No evidence of exfiltration or hidden data collection.CVE-2026-20182.py:68-74CVE-2026-20182.py:481-571

Author Contact

Payload withheldAuthor contact information is present but does not constitute backdoor behavior.README.md:39

Classification basis

The artifact contains a complete Python script that constructs and sends malicious payloads to the vulnerable endpoint to achieve remote code execution, including command execution, output exfiltration, and reverse shell capabilities. This goes beyond detection or scanning; it actively exploits the vulnerability.

Requirements

• Target running vulnerable DbGate version (≤ 7.1.8)README.md:3
• Network access to the target's /runners/start endpointCVE-2026-47668.py:795-806

Observed behavior

• Sends a JSON payload to POST /runners/start with a crafted functionName containing injected JavaScript that executes an OS command via child_process.execSync or execCVE-2026-47668.py:421-428CVE-2026-47668.py:466-495CVE-2026-47668.py:795-806
• Starts an HTTP server to receive exfiltrated command output from the targetCVE-2026-47668.py:500-567CVE-2026-47668.py:569-595
• Optionally starts a TCP listener to receive a reverse shell connection from the targetCVE-2026-47668.py:598-690
• Automatically obtains a Bearer token by sending a login request to /auth/login if no token is providedCVE-2026-47668.py:770-793

Observables

Exploit Behavior

Payload withheldThis is the expected behavior for a PoC exploiting the described CVE-2026-47668 vulnerability.CVE-2026-47668.py:773-793CVE-2026-47668.py:795-816

Exfiltration Mechanism

Payload withheldThis is a standard technique for confirming command execution in a blind RCE scenario and is explicitly documented in the README.CVE-2026-47668.py:500-566README.md:170-212

Reverse Shell Capability

Payload withheldThis is an optional feature for authorized testing, clearly documented and disabled by default. It is not a hidden backdoor.CVE-2026-47668.py:396-418README.md:244-283

Output Directory

Payload withheldThis is standard logging for a security tool and does not indicate any hidden data exfiltration from the operator's machine.CVE-2026-47668.py:30-38CVE-2026-47668.py:91-115

Classification basis

The script actively exploits the vulnerability by extracting a nonce, triggering a password reset, and verifying account takeover through login and admin access checks. It goes beyond detection or scanning by modifying user credentials and confirming unauthorized access.

Requirements

• Target running Academy LMS ≤ 3.5.0 with course pages exposing academy_nonceREADME.md:25-27
• Target URL list file with one URL per lineCVE-2025-15521.py:712-715

Observed behavior

• Extracts academy_nonce from course pages via regex patternsCVE-2025-15521.py:208-240
• Sends POST request to reset handler with extracted nonce, new password, and user_id to change password without authenticationCVE-2025-15521.py:314-359
• Enumerates usernames via author ID redirects and REST APICVE-2025-15521.py:375-417
• Attempts WordPress login with new password and verifies admin access via admin UI markersCVE-2025-15521.py:514-581
• Writes confirmed account credentials to output fileCVE-2025-15521.py:623-629

Observables

Exploit Behavior

Payload withheldThe script performs the exact steps described in the README: nonce extraction from course pages, password reset via POST to /academy-retrieve-password/, username enumeration via author archives and REST API, and strict admin access verification. This is consistent with a legitimate PoC for the stated vulnerability.CVE-2025-15521.py:208-240CVE-2025-15521.py:314-359CVE-2025-15521.py:375-417CVE-2025-15521.py:514-581

Output File Writing

Payload withheldThe script writes successful login credentials (username and password) to a local file. This is part of the stated functionality to record confirmed access and does not involve exfiltration to a remote server.CVE-2025-15521.py:624-628

Author Contact

Payload withheldAuthor identification is present in the script banner and README. This is standard attribution and does not constitute backdoor behavior.CVE-2025-15521.py:6-8README.md:151-152

Classification basis

The artifact contains executable Python code that actively sends the exploit primitive (AJAX request to poison admin_order), registers users, logs in, and uploads a plugin to achieve RCE. This is code intended to exercise the vulnerability, not merely detect it.

Requirements

• Target WordPress site running RegistrationMagic plugin version <= 6.0.7.1README.md:42
• Python 3.8+ with requests, colorama, urllib3 installedREADME.md:168

Observed behavior

• Sends unauthenticated POST request to /wp-admin/admin-ajax.php with action=rm_user_exists and order=,menu1 to poison the rm_admin_order optionCVE-2025-15403.py:414-432
• Registers a new WordPress subscriber account via smart form detection on registration pagesCVE-2025-15403.py:332-384
• Logs in with the escalated subscriber account and verifies admin dashboard access, plugin install page access, and uploads a test plugin to confirm RCECVE-2025-15403.py:635-727

Observables

Exploit Behavior

Payload withheldCore exploit primitive targeting the stated CVE-2025-15403 vulnerability.CVE-2025-15403.py:414-432

Exploit Behavior

Payload withheldMode 0 functionality to create a subscriber account for privilege escalation.CVE-2025-15403.py:332-384

Exploit Behavior

Payload withheldMode 2 verification that escalated privileges grant admin access.CVE-2025-15403.py:457-510

Exploit Behavior

Payload withheldUploads a benign 'Nxploited' plugin to confirm RCE; the plugin only echoes 'Nxploited'.CVE-2025-15403.py:519-535CVE-2025-15403.py:544-601

Output File

Payload withheldLogs successful plugin uploads for verification; does not exfiltrate data.CVE-2025-15403.py:623-629

Classification basis

The primary artifact is a Python script that actively sends a crafted HTTP request to a target to create an administrator account, which is the definition of an exploit. The script's main function, lakit_register_admin, constructs and sends the malicious payload, and the verify_full_admin function confirms the resulting privilege escalation.

Requirements

• Target must be running a vulnerable version of the LA-Studio Element Kit for Elementor plugin (<= 1.5.6.3).README.md:40
• The target's front-end HTML must expose a valid ajaxNonce.CVE-2026-0920.py:81-132

Observed behavior

• Extracts a publicly accessible ajaxNonce from the target site's front-end HTML.CVE-2026-0920.py:81-132
• Sends a POST request to /wp-admin/admin-ajax.php with action=lakit_ajax and a JSON payload containing attacker-controlled credentials and the parameter lakit_bkrole=1 to trigger administrator role assignment.CVE-2026-0920.py:136-198
• Verifies the created administrator account by logging into /wp-login.php and confirming access to /wp-admin/plugin-install.php.CVE-2026-0920.py:202-315
• Writes successful exploitation results, including target URL and credentials, to a file named success_results.txt.CVE-2026-0920.py:381-388

Observables

Credential Handling

Payload withheldCredentials are used only in the exploit request and local result file; no exfiltration to external server observed.CVE-2026-0920.py:24-26CVE-2026-0920.py:136-198CVE-2026-0920.py:381-388

Network Communication

Payload withheldAll network requests target the supplied victim site; no calls to external command-and-control or exfiltration endpoints.CVE-2026-0920.py:157-198CVE-2026-0920.py:202-315

Author Contact

Payload withheldContact information present in script and README; no evidence of hidden communication channels.CVE-2026-0920.py:20-21README.md:14-15

Classification basis

The Python script CVE-2025-6389.py contains code that actively exploits the vulnerability by sending a payload to create an administrative user on the target system, which is the definition of an exploit.

Requirements

• Target must be running a vulnerable version of the Sneeit Framework plugin (<= 8.3) on WordPress.README.md:42
• The target's admin-ajax.php endpoint must be reachable.CVE-2025-6389.py:114

Observed behavior

• Sends a POST request to /wp-admin/admin-ajax.php with action=sneeit_articles_pagination, callback=var_dump, and args=['test'] to test for vulnerability.CVE-2025-6389.py:117-123
• If the test response contains 'array(1)', '[0]', and '"test"', the target is considered vulnerable.CVE-2025-6389.py:100-103
• Sends a second POST request to the same endpoint with callback=wp_insert_user and arguments to create a new WordPress administrator account with a hardcoded password.CVE-2025-6389.py:135-141
• Logs successful exploits to payload withheld with the target URL, username, password, and email.CVE-2025-6389.py:87-92

Observables

Exploit Behavior

Payload withheldThis is the documented exploit chain for CVE-2025-6389 and matches the vulnerability description.CVE-2025-6389.py:116-146

Hardcoded Credentials

Payload withheldThe password for the created admin account is hardcoded and documented in the README. This is part of the exploit, not a hidden backdoor.CVE-2025-6389.py:47

Output File

Payload withheldSuccessful exploits are logged to a local file. This is expected behavior for a PoC tool and does not indicate exfiltration to an external server.CVE-2025-6389.py:48CVE-2025-6389.py:87-92

Classification basis

The script actively uploads a user-supplied file to a target server via the vulnerable AJAX endpoint, which is the core action of exploiting the vulnerability. It does not merely detect or report the vulnerability; it performs the file upload to achieve remote code execution.

Requirements

• A target running a vulnerable version (<= 2.1.0) of the g-FFL Checkout WordPress plugin.README.md:2
• A PHP web shell file to upload.CVE-2025-68001.py:98-101
• A list of target URLs.CVE-2025-68001.py:92-95

Observed behavior

• Fetches the /checkout page to extract a nonce.CVE-2025-68001.py:148-152
• Sends a POST request to /wp-admin/admin-ajax.php with action=ffl_upload_document, the extracted nonce, and the shell file disguised as image/png.CVE-2025-68001.py:209-220
• Parses the JSON response to extract the uploaded file path.CVE-2025-68001.py:224-245
• Writes successful exploit results (target URL, file path, filename) to success_results.txt.CVE-2025-68001.py:133-135CVE-2025-68001.py:306-307

Observables

Exploit Behavior

Payload withheldThis is the core exploit functionality matching the CVE description. The script reads a shell file from disk and sends it as a multipart POST to /wp-admin/admin-ajax.php.CVE-2025-68001.py:181-245

File Operation

Payload withheldThe script appends target URL, file path, and filenames to a local results file. This is expected logging for a PoC tool.CVE-2025-68001.py:133-135CVE-2025-68001.py:306-307

Network Communication

Payload withheldAll network requests are directed at the user-supplied target list and are necessary for the exploit. No calls to external C2, telemetry, or unrelated services are present.CVE-2025-68001.py:138-154CVE-2025-68001.py:196-220

User Interaction

Payload withheldThe script requires explicit user input for the shell file to upload, confirming it does not bundle or fetch a hidden payload.CVE-2025-68001.py:92-116

Classification basis

The Python script actively exploits CVE-2025-53580 by sending crafted POST requests to reset user passwords without authentication, then authenticates with the new password and verifies administrative access. It does not merely detect or report the vulnerability; it performs the full privilege escalation chain.

Requirements

• Target running Simple Business Directory Pro plugin version < 15.6.9 with exposed SBD restore pageCVE-2025-53580.py:229-247README.md:33-34

Observed behavior

• Discovers SBD restore page by probing 24 candidate paths and checking for 'sbd' in response bodyCVE-2025-53580.py:229-247
• Resets passwords for user IDs 1-3 by POSTing qcpd-restore-pwd, qcpd-uid, and pass parameters to the restore URLCVE-2025-53580.py:249-272
• Enumerates usernames via author parameter redirects, REST API, and hostname heuristicsCVE-2025-53580.py:165-227
• Logs into WordPress with the injected password and verifies admin access via REST API and dashboard markersCVE-2025-53580.py:274-357
• Writes confirmed successful logins with admin status to an output fileCVE-2025-53580.py:359-375

Observables

Fixed Password

Payload withheldThe script resets user passwords to a hardcoded value (line 38) and uses it for login (line 262, 285). This is the documented exploit mechanism, not a hidden backdoor.CVE-2025-53580.py:38CVE-2025-53580.py:262CVE-2025-53580.py:285

Output File

Payload withheldSuccessful login hits are written to a local file (line 36, 364-375). This is part of the exploit's reporting, not a backdoor.CVE-2025-53580.py:36CVE-2025-53580.py:364-375

Network Requests

Payload withheldAll network requests are directed at the target site to perform the documented exploit steps (password reset, login, admin verification). No external or unrelated endpoints are contacted.CVE-2025-53580.py:249-272CVE-2025-53580.py:274-303CVE-2025-53580.py:305-321CVE-2025-53580.py:323-357

Classification basis

The Python script actively uploads a user-provided PHP web shell to a vulnerable target, verifies its presence, and saves the URL for later use. This constitutes exploitation, not mere detection or scanning. The README explicitly describes the attack flow as 'Upload shell' and 'Verify shell'.

Requirements

• Target running vulnerable Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3README.md:2
• User-supplied PHP web shell file present on local filesystemCVE-2025-29009.py:105-108
• Target's frontend exposes wkwcpaFrontObj JavaScript object containing ajaxUrl and ajaxNonceREADME.md:34

Observed behavior

• Reads target URLs from a file and enqueues them for multithreaded processingCVE-2025-29009.py:118-132
• Fetches frontend pages to extract the AJAX nonce from the wkwcpaFrontObj JavaScript objectCVE-2025-29009.py:143-179
• Uploads a local PHP file via a multipart POST request to the extracted AJAX endpoint with action=wkwcpa_handle_prescription_session and type=uploadCVE-2025-29009.py:216-241
• Parses the JSON response to extract the uploaded shell's public URLCVE-2025-29009.py:254-283
• Verifies the uploaded shell by sending a GET request and checking for a user-defined signature string in the response bodyCVE-2025-29009.py:286-298
• Saves verified shell URLs to payload withheldCVE-2025-29009.py:135-140

Observables

Exploit Behavior

Payload withheldThis is the normal, stated behavior of the CVE-2025-29009 exploit. The script does not contain any hidden or unrelated actions.CVE-2025-29009.py:216-283CVE-2025-29009.py:286-298

User Interaction

Payload withheldThe script does not contain any hardcoded shell or backdoor; it relies entirely on user-provided files and strings.CVE-2025-29009.py:90-115

Output File

Payload withheldThe script saves verified shell URLs to a local file named payload withheld. This is a standard output mechanism for an exploit scanner.CVE-2025-29009.py:135-140

Classification basis

The artifact contains code that actively resets passwords, logs into WordPress admin accounts, and deploys a web shell. The README describes it as implementing 'attack chains' for 'Admin Takeover + Shell Upload'. This is exploitation, not detection or scanning.

Requirements

• Target WordPress site with vulnerable User Profile Builder plugin (< 3.15.2).README.md:31
• A list of target URLs provided in a file.CVE-2025-15030.py:961
• Optional: payload withheld file in the script directory for shell upload.README.md:89

Observed behavior

• Initiates an unauthenticated password reset for the 'admin' user via wp-login.php.CVE-2025-15030.py:619-681
• Enumerates WordPress usernames via author archives, REST API, and hostname heuristics.CVE-2025-15030.py:218-240
• Attempts to log in with the new password and verifies admin access by checking multiple /wp-admin/ pages.CVE-2025-15030.py:246-299
• Exploits Profile Builder's recover_password2 action to reset passwords using a provided reset link.CVE-2025-15030.py:734-784
• Uploads a malicious plugin (payload withheld) or writes a PHP shell via the plugin/theme editor after gaining admin access.CVE-2025-15030.py:413-566
• Logs successful admin logins and deployed shell URLs to output files.CVE-2025-15030.py:593-600CVE-2025-15030.py:408-411

Observables

Fixed Password

Payload withheldHardcoded password used for all password reset and login attempts against operator-supplied targets.CVE-2025-15030.py:968

Shell Upload

Payload withheldThe script attempts to upload a local payload withheld plugin to compromised targets to deploy a webshell at /wp-content/plugins/Nxploited/Nx.php. This is a disclosed post-exploitation action.CVE-2025-15030.py:388-406CVE-2025-15030.py:413-566

Output File

Payload withheldSuccessful shell deployments are logged locally with target URL, credentials, and shell path.CVE-2025-15030.py:408-411

Classification basis

The Python script actively performs the full attack chain: it locates the vulnerable endpoint, extracts a nonce, enumerates users, resets their passwords, and then verifies administrative access. This constitutes exploitation, not just detection or scanning. The README explicitly describes it as an 'Authentication Bypass → Password Reset → RCE' attack flow.

Requirements

• A target running a vulnerable version of the WordPress Simple Link Directory plugin (< 14.8.1).README.md:27
• A list of target URLs provided in a file.CVE-2025-49901.py:816

Observed behavior

• Locates the vulnerable password reset page by probing a list of common paths and checking for specific HTML content.CVE-2025-49901.py:351-406
• Extracts a WordPress nonce from the page's HTML or JavaScript to use in the password reset request.CVE-2025-49901.py:254-302
• Enumerates valid WordPress usernames via author archives, the REST API, and domain name heuristics.CVE-2025-49901.py:418-485
• Sends a crafted POST request to the reset endpoint to change the password for each enumerated user to a fixed value.CVE-2025-49901.py:488-530
• Verifies successful exploitation by checking for an authenticated session cookie and access to WordPress admin pages.CVE-2025-49901.py:533-589
• Attempts a direct login with the newly set password as a secondary verification method.CVE-2025-49901.py:613-674
• Logs successfully compromised accounts to an output file.CVE-2025-49901.py:757-761

Observables

Hardcoded Password

Payload withheldThe password injected into target accounts during the reset flow, defined at line 64 and used in reset and login functions.CVE-2025-49901.py:64CVE-2025-49901.py:499CVE-2025-49901.py:706

Output File Path

Payload withheldLocal file where verified credentials are written; no network exfiltration.CVE-2025-49901.py:65CVE-2025-49901.py:710-711CVE-2025-49901.py:760-761

Author Contact

Payload withheldAuthor identification in script banner and README; no malicious behavior associated.CVE-2025-49901.py:4-6CVE-2025-49901.py:74README.md:158-162

Classification basis

The script actively sends a crafted HTTP POST request to create an administrator account on a remote target, which is the definition of an exploit. It does not merely detect or report the vulnerability; it exercises it to achieve unauthorized access.

Requirements

• Target must have the vulnerable Frontend Admin by DynamiApps plugin (<= 3.28.20) installed and a public ACF frontend form accessible on a common registration path.README.md:28CVE-2025-13342.py:43-71

Observed behavior

• Loads a list of target URLs from a user-specified file.CVE-2025-13342.py:171-177
• Probes each target on a list of 28 common registration paths to find a page containing an ACF frontend form.CVE-2025-13342.py:43-71CVE-2025-13342.py:422-444
• Parses the discovered form to extract hidden ACF fields (_acf_nonce, _acf_form) and map user input fields (username, email, password, role).CVE-2025-13342.py:214-290CVE-2025-13342.py:293-347
• Constructs a POST payload that includes the mapped fields with hardcoded attacker credentials and sets the role field to 'administrator'.CVE-2025-13342.py:350-404CVE-2025-13342.py:557-559
• Sends the crafted payload to /wp-admin/admin-ajax.php with action=frontend_admin/form_submit to create a new administrator user.CVE-2025-13342.py:501-524
• Checks the response for 'success: true' and logs successful admin creations to acf_success.txt.CVE-2025-13342.py:407-419CVE-2025-13342.py:447-458

Observables

Hardcoded Credentials

Payload withheldThe exploit uses fixed credentials to create an administrator account on vulnerable targets. This is part of the normal exploit behavior described in the README and does not constitute a backdoor.CVE-2025-13342.py:557-559

Exploit Payload

Payload withheldThe script constructs and sends a payload to create an administrator user. This is the core exploit action and matches the CVE description.CVE-2025-13342.py:391CVE-2025-13342.py:401CVE-2025-13342.py:503

Success Logging

Payload withheldThe script logs successful exploits locally. This is a standard operational feature for an exploit tool and does not indicate hidden data exfiltration.CVE-2025-13342.py:447-458

Classification basis

The script's Mode 3 (exploit mode) actively sends a crafted request to the vulnerable AJAX endpoint to trigger a site reset and privilege escalation, which constitutes exploitation, not just detection or scanning.

Requirements

• A valid WordPress subscriber account with activated credentials.CVE-2025-14364.py:435README.md:55
• Target must have the vulnerable Demo Importer Plus plugin (<= 2.0.8) installed.README.md:34

Observed behavior

• Authenticates to WordPress using supplied credentials via /wp-login.php.CVE-2025-14364.py:213-272
• Extracts a WordPress REST nonce from the /wp-admin/ page source.CVE-2025-14364.py:275-360
• Sends a POST request to /wp-admin/admin-ajax.php with action=demo_importer_plus and payload {"demo_action":"do-reinstall"} to trigger a full site reset.CVE-2025-14364.py:363-416
• Logs successful exploitation, recording the target URL and credentials with admin privileges.CVE-2025-14364.py:447-449

Observables

Network Activity

Payload withheldDemonstrates that the tool only interacts with the intended WordPress targets.CVE-2025-14364.py:129-138CVE-2025-14364.py:141-210CVE-2025-14364.py:363-416CVE-2025-14364.py:419-470

File Write

Payload withheldLogging is local and transparent; no evidence of exfiltration or hidden file operations.CVE-2025-14364.py:21-25CVE-2025-14364.py:71-81CVE-2025-14364.py:180-193CVE-2025-14364.py:244-257CVE-2025-14364.py:401CVE-2025-14364.py:448-449

Credential Handling

Payload withheldCredentials are used solely for the intended exploit flow.CVE-2025-14364.py:38-39CVE-2025-14364.py:213-272CVE-2025-14364.py:419-470

Classification basis

The artifact's primary purpose is to exploit CVE-2025-2563 by actively creating an administrator account on vulnerable targets. The README describes it as a 'Proof-of-Concept (PoC) mass exploitation scanner' and the code implements a full attack chain: registration, role injection, and admin verification. The code contains the exploit payload ('role': 'administrator') and writes compromised credentials to a file.

Requirements

• Target must run a vulnerable version (< 4.1.2) of the User Registration & Membership plugin with the Membership Addon enabled.README.md:2README.md:37
• The target's membership registration pages must be accessible to extract nonces and form tokens.CVE-2025-2563.py:301-347

Observed behavior

• Fetches membership pricing and registration pages to discover form tokens, nonces, and membership IDs.CVE-2025-2563.py:301-347
• Registers a new user account via the user_registration_user_form_submit AJAX action, iterating through token combinations.CVE-2025-2563.py:350-413
• Exploits the vulnerability by sending a crafted user_registration_membership_register_member AJAX request with 'role': 'administrator' to escalate privileges.CVE-2025-2563.py:490-569
• Verifies the escalated privileges by logging into WordPress and checking for admin panel indicators.CVE-2025-2563.py:416-487
• Writes successfully exploited admin credentials to an output file (Nx_admin.txt).CVE-2025-2563.py:107-114CVE-2025-2563.py:555

Observables

Credential Harvesting

Payload withheldThe tool creates accounts with a fixed password, which could be used by the operator to access compromised sites. This is inherent to the exploit's purpose and not a hidden backdoor.CVE-2025-2563.py:30

File Write

Payload withheldThe tool logs compromised credentials locally. This is expected behavior for a PoC exploit scanner and does not indicate exfiltration or hidden persistence.CVE-2025-2563.py:28-29CVE-2025-2563.py:97-114

Network Activity

Payload withheldAll network activity is directed at the user-supplied targets and is consistent with the described exploit chain. No calls to unrelated external servers were found.CVE-2025-2563.py:301-347CVE-2025-2563.py:350-413CVE-2025-2563.py:490-569

Classification basis

The artifact is a fully functional Python script that actively exploits CVE-2026-1492 by sending crafted HTTP requests to vulnerable WordPress sites to create administrator accounts. It does not merely detect or report the vulnerability; it performs the privilege escalation.

Requirements

• Target must run a vulnerable version (<= 5.1.2) of the User Registration & Membership plugin.README.md:33
• The target's registration and membership AJAX endpoints must be accessible.CVE-2026-1492.py:638-654

Observed behavior

• Discovers membership plans and registration pages by crawling common paths like /membership-pricing/ and /registration/.CVE-2026-1492.py:144-202
• Extracts nonces, form IDs, and AJAX parameters from the registration page HTML.CVE-2026-1492.py:277-431
• Registers a new user account via the user_registration_user_form_submit AJAX action.CVE-2026-1492.py:638-739
• Sends a second AJAX request (user_registration_membership_register_member) with a members_data payload containing '"role": "administrator"' to escalate privileges.CVE-2026-1492.py:743-753
• Verifies the created account has administrative access by logging in and checking for admin dashboard indicators.CVE-2026-1492.py:1013-1072
• Writes successfully created admin credentials to a file (Nx_admin.txt).CVE-2026-1492.py:100-102

Observables

Exploit Behavior

Payload withheldThis is the documented exploit for CVE-2026-1492 and matches the vulnerability description.CVE-2026-1492.py:638-739CVE-2026-1492.py:756-842

Credential Storage

Payload withheldThis is standard output logging for a PoC tool and does not indicate exfiltration to an external party.CVE-2026-1492.py:100-107

Author Contact

Payload withheldAuthor attribution is present but does not constitute backdoor behavior.CVE-2026-1492.py:85README.md:293-301

Classification basis

The artifact is a fully functional Python script that actively exploits CVE-2026-4484 by sending a crafted POST request to the vulnerable REST API endpoint to change a user's role to 'administrator'. It performs the complete attack chain: registration (optional), login, privilege escalation, and verification of admin access. The README explicitly describes it as a 'Proof-of-Concept (PoC) exploitation script'.

Requirements

• A target WordPress site running Masteriyo LMS version <= 2.1.6README.md:30
• For Nx_1 mode: target site must have open registration enabledCVE-2026-4484.py:411-475
• For Nx_2 mode: valid Student-level or higher credentials for the target siteCVE-2026-4484.py:612-641

Observed behavior

• Registers a new user account on the target WordPress site via the Masteriyo signup formCVE-2026-4484.py:411-475
• Logs in to the target site using the Masteriyo AJAX login endpointCVE-2026-4484.py:345-405
• Extracts the user ID and a nonce from the Masteriyo dashboard pageCVE-2026-4484.py:481-505
• Sends a POST request to /wp-json/masteriyo/v1/users/instructors/{user_id} with payload {"roles": ["administrator"]} to escalate privilegesCVE-2026-4484.py:507-546
• Re-authenticates with a fresh session and verifies admin access by checking /wp-admin/ pagesCVE-2026-4484.py:602-610
• Writes successfully escalated credentials to payload withheld in the format 'https://site.com/wp-login.php user:email|pass:password'CVE-2026-4484.py:552-569

Observables

Exploit Behavior

Payload withheldThis is the documented exploit for CVE-2026-4484. The script performs exactly this action to elevate a student account to administrator.CVE-2026-4484.py:521-524

Output File

Payload withheldThe script writes successful admin credentials to this local file in the format 'https://site.com/wp-login.php user:email|pass:password'. This is the documented output and does not exfiltrate data.CVE-2026-4484.py:552-569

Admin Verification

Payload withheldAfter escalation, the script re-authenticates and checks for admin dashboard and plugin installation access to confirm the privilege escalation succeeded. This is part of the PoC verification, not a backdoor.CVE-2026-4484.py:255-339

Classification basis

The Python script actively sends crafted HTTP requests to vulnerable endpoints to upload a web shell (Mode 1) and create an administrator account (Mode 2), which constitutes exploitation rather than mere detection or scanning. The README explicitly describes it as a 'Proof-of-Concept (PoC) exploitation script'.

Requirements

• Target WordPress site running vulnerable WooCommerce Wholesale Lead Capture plugin (<= 2.0.3.1).README.md:31README.md:48
• For Mode 1, a PHP web shell file must be provided locally.CVE-2026-2754 CVE-2026-27540.py:314-316README.md:138

Observed behavior

• Mode 1 sends an unauthenticated multipart POST request to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler to upload an arbitrary file, including a PHP web shell.CVE-2026-2754 CVE-2026-27540.py:312-327CVE-2026-2754 CVE-2026-27540.py:330-331
• Mode 1 brute-forces the dynamically generated wwlc-temp-* upload directory using pattern-based, time-based, and random hex guesses to locate and access the uploaded shell.CVE-2026-2754 CVE-2026-27540.py:396-426CVE-2026-2754 CVE-2026-27540.py:429-450CVE-2026-2754 CVE-2026-27540.py:473-563
• Mode 2 sends an unauthenticated POST request to /wp-admin/admin-ajax.php?action=wwlc_create_user with injected wp_capabilities[administrator]=1 to create a new administrator account.CVE-2026-2754 CVE-2026-27540.py:691-709CVE-2026-2754 CVE-2026-27540.py:719-720
• Mode 2 attempts to log in with the newly created administrator credentials and verifies admin panel access by checking multiple WordPress admin endpoints.CVE-2026-2754 CVE-2026-27540.py:802-803CVE-2026-2754 CVE-2026-27540.py:174-227

Observables

Exploit Behavior

Payload withheldThis is the advertised arbitrary file upload exploit for CVE-2026-27540.CVE-2026-2754 CVE-2026-27540.py:306-362CVE-2026-2754 CVE-2026-27540.py:473-563

Exploit Behavior

Payload withheldThis is the advertised privilege escalation exploit for CVE-2026-27542.CVE-2026-2754 CVE-2026-27540.py:677-733CVE-2026-2754 CVE-2026-27540.py:736-812

Fixed Credential

Payload withheldThe password is fixed and displayed to the user; it is used for the attacker-created account, not for surreptitious access.CVE-2026-2754 CVE-2026-27540.py:874-875

Output File

Payload withheldThese files log exploit outcomes locally; no exfiltration to a remote server is performed.CVE-2026-2754 CVE-2026-27540.py:586-606CVE-2026-2754 CVE-2026-27540.py:788-810

Classification basis

The artifact's primary operation is to detect and validate the vulnerability by connecting to the target, executing reconnaissance commands, and collecting data. It is explicitly labeled as a 'MASS SCANNER' in its own banner and documentation. It does not provide the operator with an interactive shell or establish a backdoor; it only verifies access and exfiltrates information, which is characteristic of a scanner.

Requirements

• Target must be running a vulnerable version of Marimo (< 0.23.0) with the /terminal/ws endpoint exposed.README.md:42-46
• Scanner requires Python 3.10+ and the websockets, rich, requests, and urllib3 libraries.README.md:100-108

Observed behavior

• Connects to the /terminal/ws WebSocket endpoint without valid authentication, using a dummy Authorization header.CVE-2026-39987.py:1107-1113
• Executes system commands (e.g., id, whoami, uname -a, ps aux, env) via the WebSocket shell to collect identity, system, and environment information.CVE-2026-39987.py:1117-1118CVE-2026-39987.py:376-381
• Enumerates sensitive files and configurations, including /etc/shadow, SSH keys, database credentials, .env files, and Marimo notebooks and tokens.CVE-2026-39987.py:654-667CVE-2026-39987.py:690-707CVE-2026-39987.py:430-521
• Writes a proof-of-concept file (Nx) to the web root and attempts to verify it via HTTP to confirm web accessibility.CVE-2026-39987.py:964-1023
• Saves all collected data into a structured per-target output directory and generates summary files.CVE-2026-39987.py:1141-1175

Observables

Target Command Execution

Payload withheldThe script sends these commands over the WebSocket to the target host to enumerate the system. This is the disclosed exploit behavior.CVE-2026-39987.py:372-378CVE-2026-39987.py:655-657

Target File Write

Payload withheldThe script writes a proof-of-concept file (e.g., Nx.py) to the target's web root to verify write access and HTTP reachability. This is a standard PoC verification step.CVE-2026-39987.py:977

Local File Write

Payload withheldThe script saves collected target data locally to the payload withheld. This is expected behavior for a scanner and does not involve exfiltration to an external party.CVE-2026-39987.py:55-58

Fixed Authorization Header

Payload withheldThe script uses a fixed, non-secret Authorization header to connect to the WebSocket. The README explicitly states the header value is irrelevant, which aligns with the CVE description of missing authentication. This is not a concealed credential.CVE-2026-39987.py:1107README.md:314

Classification basis

The script actively sends a crafted request to upload an arbitrary file to a vulnerable endpoint, which is the definition of an exploit. It does not merely check for the vulnerability's presence; it performs the upload and extracts the resulting URL for subsequent access.

Requirements

• A target running a vulnerable version of the WebStack theme (<= 1.2024).README.md:31
• A local file (e.g., a PHP webshell) to upload.CVE-2026-1555.py:105-107

Observed behavior

• Sends a multipart POST request to /wp-admin/admin-ajax.php with action=img_upload and the user-specified file.CVE-2026-1555.py:186-201
• Parses the JSON response to extract the uploaded file's URL from the 'data.src' field.CVE-2026-1555.py:205-223
• Writes the extracted shell URL to an output file (payload withheld).CVE-2026-1555.py:160-163

Observables

Exploit Behavior

Payload withheldThis is the documented exploit for CVE-2026-1555 and matches the vulnerability description.CVE-2026-1555.py:175-201

Output File

Payload withheldSuccessful shell URLs are appended to this file for later use.CVE-2026-1555.py:160-163

Network Behavior

Payload withheldCommon in PoC tools to avoid connection issues; does not indicate backdoor activity.CVE-2026-1555.py:20-21

Classification basis

The script actively uploads a user-supplied file to a target server by exploiting the missing capability check and file type validation in the vulnerable AJAX handler. It does not merely detect the vulnerability; it performs the file upload and reports the resulting shell URL, which constitutes exploitation.

Requirements

• Target WordPress site running vulnerable Pix for WooCommerce plugin (<=1.5.0).README.md:11-16
• Local shell file (e.g., shell.php) present in the script's working directory.CVE-2026-3891.py:103-108

Observed behavior

• Sends POST to wp-admin/admin-ajax.php with action=lkn_pix_for_woocommerce_generate_nonce to obtain a nonce.CVE-2026-3891.py:147-193
• Sends multipart POST to wp-admin/admin-ajax.php with action=lkn_pix_for_woocommerce_c6_save_settings, attaching the local shell file as certificate_crt_path and certificate_key_path.CVE-2026-3891.py:196-268
• Constructs the uploaded shell URL at /wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/<shellname>.php.CVE-2026-3891.py:271-288
• Appends the constructed shell URL to payload withheld and displays a success card.CVE-2026-3891.py:130-135CVE-2026-3891.py:291-318

Observables

Exploit Behavior

Payload withheldThis is the expected exploit behavior for CVE-2026-3891, an arbitrary file upload vulnerability.CVE-2026-3891.py:196-268

Output File

Payload withheldThe script appends successfully uploaded shell URLs to payload withheld for operator convenience. This is a standard post-exploitation logging mechanism.CVE-2026-3891.py:130-135

Author Contact

Payload withheldContact information is present in the README and script header but does not constitute backdoor behavior.README.md:29-30