Vimash-Dilsara/-CVE-2026-1657

GitHubRepository PoCExploitVimashDilshara/-CVE-2026-1657

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that checks the version of the EventPrime plugin and, if vulnerable or forced, uploads an arbitrary image file to the target WordPress site via the unauthenticated 'ep_upload_file_media' AJAX endpoint.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (CVE-2026-1657.py) and a README.md file. The script implements a proof-of-concept for CVE-2026-1657, which is an unauthenticated image upload vulnerability in the EventPrime WordPress plugin. The code checks the plugin version, determines if it is vulnerable, and then attempts to upload a user-supplied file to the target WordPress site via the vulnerable AJAX endpoint. No backdoor, deceptive payload, or concealed operator-directed harm was observed. The script performs only the advertised exploit behavior and does not contain any unrelated remote access, credential theft, persistence mechanisms, or hidden payloads.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareWordPressEventPrime plugin
Attack typesunauthenticated file upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads a user-supplied file to the target server via the vulnerable endpoint, which constitutes exploitation, not just detection. The README explicitly labels it an 'exploit'.

CVE-2026-1657.py:46-77README.md:2

Requirements

  • Target must be running a vulnerable version of the EventPrime plugin (<= 4.2.8.4) or the user must choose to force the upload.CVE-2026-1657.py:35-44CVE-2026-1657.py:100-102
  • Attacker must supply a target URL and a local file path to upload.CVE-2026-1657.py:83-88

Observed behavior

  • Fetches the plugin's readme.txt to extract the stable version tag.CVE-2026-1657.py:19-29
  • Compares the detected version against 4.2.8.4 to determine vulnerability.CVE-2026-1657.py:31-44
  • Sends a POST request to /wp-admin/admin-ajax.php with action=ep_upload_file_media and the supplied file, without any authentication or nonce.CVE-2026-1657.py:46-57
  • Parses the JSON response to confirm success and prints the attachment ID and predicted public URL of the uploaded file.CVE-2026-1657.py:59-69
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Unauthenticated file upload via ep_upload_file_media AJAX endpointThe script directly implements the CVE-2026-1657 vulnerability by sending a POST request with a file to /wp-admin/admin-ajax.php using the action 'ep_upload_file_media'.CVE-2026-1657.py:46-77
Version Check
Checks plugin version against known vulnerable range (<=4.2.8.4)The script attempts to read the readme.txt file to extract the stable tag and compares it to the vulnerable version range.CVE-2026-1657.py:19-44
Review boundaries

What the analysis did not establish

  • Only the Python script and README were provided; no other files from the repository were inspected.
  • The script's actual runtime behavior was not observed; analysis is based solely on static code review.
  • Only the two text files (CVE-2026-1657.py and README.md) were provided; no other files exist in the repository according to the inventory. No binary or non-text files were present to inspect.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1