Adam Kues
Source-scoped identity with 3 associated PoCs and 4 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
MetasploitWordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
Metasploit exploitby Crypto-Cat, plus 3 additional contributorsAdded to Metasploit 2026-07-31ExploitCVE-2026-60137CVE-2026-630301 file
Analysis
Technical assessment
A Metasploit exploit module that chains CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST API batch route confusion) to achieve unauthenticated remote code execution on WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. It uses SQL injection to read the database prefix and admin ID, poisons the object cache to publish a crafted customizer changeset, re-enters the REST API with admin privileges to create a new administrator account, logs in, uploads a plugin containing a Metasploit payload, and executes it.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit exploit that chains two WordPress CVEs to achieve unauthenticated RCE. It creates an admin account, uploads a payload plugin, executes it, and cleans up. No concealed operator-directed harm, unrelated payloads, or deceptive behavior was found.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively exercises the vulnerabilities to achieve remote code execution. It includes code to check for vulnerability, perform SQL injection, poison the object cache, escalate privileges, create an admin account, upload a payload, and execute it. The module type is 'exploit' and the description states it 'gain[s] unauthenticated remote code execution'.
modules/exploits/multi/http/wp_batch_desync_rce.rb:1-812modules/exploits/multi/http/wp_batch_desync_rce.rb:42-58Requirements
- Target must be running a vulnerable version of WordPress (6.9.0-6.9.4 or 7.0.0-7.0.1) with the REST API batch endpoint reachable.
modules/exploits/multi/http/wp_batch_desync_rce.rb:44-46 - At least one published post or page must exist on the target for oEmbed resolution.
modules/exploits/multi/http/wp_batch_desync_rce.rb:193 - The target must not use a persistent object cache that prevents forged UNION rows from surviving into the cache.
modules/exploits/multi/http/wp_batch_desync_rce.rb:163
Observed behavior
- Checks if the target is running a vulnerable WordPress version and confirms the batch route-confusion SQL injection is exploitable via in-band UNION.
modules/exploits/multi/http/wp_batch_desync_rce.rb:125-171 - Discovers the WordPress database table prefix and an existing administrator user ID via SQL injection.
modules/exploits/multi/http/wp_batch_desync_rce.rb:255-286 - Seeds oEmbed cache posts by injecting forged posts containing embed shortcodes, then extracts their post IDs.
modules/exploits/multi/http/wp_batch_desync_rce.rb:301-321 - Builds a poison graph and forged wp_posts rows to poison the object cache, then triggers the escalation chain to create a new administrator account via the REST API.
modules/exploits/multi/http/wp_batch_desync_rce.rb:323-347 - Logs in as the newly created administrator, uploads a plugin containing a Metasploit payload, and executes it to obtain a session.
modules/exploits/multi/http/wp_batch_desync_rce.rb:215-222 - Cleans up by removing the uploaded plugin and the created administrator account (unless KeepAdmin is set).
modules/exploits/multi/http/wp_batch_desync_rce.rb:224-238
Behaviors behind the backdoor verdict
Observables
- Credential Creation
- Payload withheldThe module creates a new WordPress administrator account to upload and execute a payload. This is documented exploit behavior, not a backdoor.
modules/exploits/multi/http/wp_batch_desync_rce.rb:328-333 - Payload Upload
- Payload withheldThe module uploads a plugin containing the user-selected Metasploit payload and triggers it. This is standard Metasploit exploit behavior.
modules/exploits/multi/http/wp_batch_desync_rce.rb:427-443 - Cleanup
- Payload withheldThe module removes the created admin account and uploaded plugin after obtaining a session, unless KeepAdmin is set. This is normal cleanup, not concealment.
modules/exploits/multi/http/wp_batch_desync_rce.rb:224-238
What the analysis did not establish
- Only the module source code and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not included.
- The analysis is based solely on static review of the source code; the module was not executed, and its behavior is inferred from the code logic.
- Only the module source and metadata were reviewed; framework mixins, libraries, and external payloads were not expanded or analyzed.
- Binary files were not inspected; metadata-only analysis was performed for any non-text content.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitcPanel/WHM CRLF Injection Authentication Bypass RCE
Metasploit exploitby Crypto-Cat, plus 2 additional contributorsAdded to Metasploit 2026-05-15ExploitCVE-2026-419401 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2026-41940, a CRLF injection vulnerability in cPanel/WHM's cpsrvd daemon, to achieve unauthenticated remote code execution as root. It bypasses authentication by injecting session fields via a crafted Basic-auth header, promotes them to the session cache, uses the WHM JSON API to set a temporary root password, and delivers a payload over SSH.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a documented exploit for CVE-2026-41940. It performs authentication bypass via CRLF injection, sets a temporary root password, delivers a payload over SSH, and rotates the password. All behavior is consistent with the stated exploit purpose and contains no concealed, deceptive, or unrelated harmful actions.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that performs authentication bypass and remote code execution. It includes a check method for vulnerability detection, but its primary purpose is exploitation: it injects session fields, promotes them, sets a root password, and opens an SSH command shell to deliver a payload. The module type is 'exploit' and the source metadata confirms it is an exploit.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:11modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:222-355modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:24Requirements
- Target must be running a vulnerable version of cPanel/WHM (after 11.40, before patched versions).
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:39-41 - Target must have WHM service accessible on the configured RPORT (default 2087) with SSL enabled.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:72-75 - Target must have SSH service accessible on the configured SSHPORT (default 22).
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:86 - DefangedMode must be set to false to allow the module to change the root password.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:223-229
Observed behavior
- Mints a pre-auth session by sending a POST request to /login with random credentials and extracting the whostmgrsession cookie.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:95-112 - Injects session fields (user=root, hasroot=1, etc.) via a CRLF injection in the Basic-auth password, bypassing the encoder by omitting the ob-part of the session cookie.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:114-134 - Promotes the injected fields into the authoritative session cache by requesting /scripts2/listaccts.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:136-146 - Verifies root WHM access by retrying a request to /json-api/version until a 200 response with version data is received.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:148-160 - Sets a temporary root password via the WHM JSON API passwd endpoint.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:255-278 - Establishes an SSH connection as root using the temporary password and opens a command shell session.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:280-301 - Rotates the root password to a new random value after the SSH session is established.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:306-330 - Stores the rotated root credential in the Metasploit database.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:335-352
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe module injects session fields via a crafted Basic-auth header to gain unauthorized root access, which is the core of the documented CVE-2026-41940 exploit.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:114-134 - Exploit Behavior
- Payload withheldThe module uses the passwd API endpoint to set a temporary root password for SSH access, as described in the module's description.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:255-278 - Exploit Behavior
- Payload withheldAfter setting the temporary password, the module connects via SSH, establishes a command stream, and rotates the root password to a new random value, as described.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:280-355 - Safety Mechanism
- Payload withheldThe module includes a DefangedMode option (default true) that must be explicitly set to false to proceed, preventing unintended password changes.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:90modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:223-229
What the analysis did not establish
- Analysis is based on module source code and metadata only; Metasploit framework mixins, libraries, and external payloads are not expanded.
- The module's actual runtime behavior, reliability, and safety are not verified by execution.
- Review is limited to the module source code and metadata; framework mixins, libraries, and external payloads are not expanded or analyzed.
- Binary files are flagged as metadata-only and not analyzed, but no binary files are present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.