whyiamsobusy

GitHub · Repository owner · Source ID 252200060
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

whyiamsobusy/CVE-2026-4350

Repository PoC0Created 2026-04-11ScannerCVE-2026-435011 files

2.5 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Nuclei template that checks for the presence of CVE-2026-4350 by sending a GET request with a path traversal payload to delete wp-config.php. It does not contain exploit code that exercises the vulnerability to achieve file deletion or site takeover; the template only detects the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Nuclei template for CVE-2026-4350. The README describes the vulnerability and provides commands to run an exploit and a PoC script, but neither script is included in the reviewed text. The Nuclei template contains a standard HTTP request for detecting the vulnerability. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed files.

ClassificationScanner
Model confidence95%
AuthenticationRequired
Languagesyaml
Target softwarePerfmatters WordPress plugin
Attack typespath traversalarbitrary file deletion
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Nuclei template (nuclei/cve-2026-4350.yaml) that defines a single HTTP request to check for the vulnerability. It does not contain code to exploit the vulnerability (e.g., to delete a file or take over the site); it only detects the presence of the vulnerable endpoint. The README references separate exploit and PoC scripts, but those files are not included in the evidence.

nuclei/cve-2026-4350.yaml:1-10README.md:13-17

Requirements

  • Target must be running a vulnerable version of the Perfmatters plugin (<= 2.5.9.1).README.md:11
  • Attacker must be authenticated with at least Subscriber-level access.nuclei/cve-2026-4350.yaml:1-10

Observed behavior

  • Sends an HTTP GET request to /wp-admin/admin-ajax.php with parameters action=perfmatters_delete and delete=../../../../wp-config.php.nuclei/cve-2026-4350.yaml:8-10
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Reference
Payload withheldThe README instructs the user to run an exploit script, but the script itself is not included in the evidence.README.md:14
Command Reference
Payload withheldThe README instructs the user to run a PoC script, but the script itself is not included in the evidence.README.md:17
Nuclei Template
Payload withheldThe Nuclei template contains a standard detection request for the CVE-2026-4350 path traversal vulnerability.nuclei/cve-2026-4350.yaml:8-10
Review boundaries

What the analysis did not establish

  • Only 2 of 11 files in the repository are included in the evidence. The README references exploit/exploit.py and poc/poc.sh, but these files are not provided, so their content cannot be analyzed.
  • The Nuclei template lacks authentication handling; it does not show how credentials are supplied, which is required to trigger the vulnerability.
  • Only 2 of 11 files in the repository were provided as text; 9 files were omitted. The referenced exploit/exploit.py and poc/poc.sh scripts are not included in the evidence and were not reviewed.
  • Binary files were flagged as metadata-only and not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.