shinthink/CVE-2026-3891

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2026-3891 that performs unauthenticated arbitrary file upload and remote code execution against the Pix for WooCommerce WordPress plugin. The script obtains a nonce via an unauthenticated AJAX endpoint, uploads a PHP webshell through the vulnerable certificate_crt_path parameter, and executes commands on the target.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward exploit for CVE-2026-3891. It uploads a PHP webshell to a vulnerable WordPress plugin and executes commands. The webshell payload is token-protected and self-cleaning by default. No concealed backdoor, credential theft, persistence, or unrelated payload was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwarePix for WooCommerceWordPress
Attack typesarbitrary file uploadremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete Python script that actively exploits CVE-2026-3891 by uploading a PHP webshell and executing arbitrary commands on vulnerable targets. The code performs the full attack chain: nonce retrieval, file upload, and command execution, which constitutes an exploit rather than a scanner or writeup.

cve_2026_3891.py:1-297README.md:8

Requirements

  • Target must be running Pix for WooCommerce plugin version <= 1.5.0README.md:15
  • Target must have the vulnerable AJAX endpoints accessiblecve_2026_3891.py:57-59

Observed behavior

  • Sends POST request to obtain a valid nonce without authenticationcve_2026_3891.py:127-130
  • Uploads a PHP webshell file via the certificate_crt_path parameter in a multipart POST requestcve_2026_3891.py:156-162
  • Verifies successful upload by requesting the webshell URL and checking for expected contentcve_2026_3891.py:168-169
  • Executes system commands (id;hostname;uname -a) on the target via the uploaded webshellcve_2026_3891.py:194-196
  • Optionally cleans up by deleting the uploaded webshell filecve_2026_3891.py:198-200
  • Supports mass scanning of multiple targets with configurable threadingcve_2026_3891.py:206-223
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Payload
PHP code with token-gated command execution, file upload, and self-deletionThe exploit deploys a webshell to achieve RCE as described in the CVE. The shell requires a random token to operate and includes a self-deletion feature, which is consistent with a responsible PoC.cve_2026_3891.py:63-83
Cleanup Behavior
Default cleanup removes the uploaded shell after successful RCEThe script deletes the webshell by default after command execution, reducing persistence risk. This is controlled by the --no-cleanup flag.cve_2026_3891.py:198-200
Review boundaries

What the analysis did not establish

  • One file (metadata only) was omitted from the evidence packet; its content was not analyzed
  • The evidence does not include the actual PHP webshell code execution output, only the script's logic to capture it
  • One file (metadata only) was omitted from text analysis; its content is unknown but flagged as non-text and not analyzed.
  • Binary content was not inspected; the review is limited to the supplied text evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1