xxconi/CVE-2026-49777-CVE-2026-10735

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that performs a multi-step exploitation chain against WordPress sites running vulnerable ShapedPlugin plugins. It detects indicators of compromise, bypasses login using a hardcoded MD5 hash, writes a webshell via a REST API backdoor, executes arbitrary OS commands, and exfiltrates credentials.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a Python script that automates exploitation of known backdoors in vulnerable WordPress plugins. It does not contain any backdoor or deceptive payload aimed at the person running the PoC. All behavior is consistent with a public exploit tool: it scans targets, attempts login bypass, writes a webshell, executes commands, and exfiltrates data from the target server. No concealed operator-directed harm against the PoC runner was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareWordPresswoo-product-slider-protestimonial-prosmart-show-post-pro
Attack typesbackdoorremote code executioncredential exfiltrationauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively performs exploitation steps including login bypass, webshell deployment, remote command execution, and data exfiltration. It is not limited to detection or validation; it exercises the vulnerability to gain unauthorized access and control.

CVE-2026-49777.py:326-401

Requirements

  • Target must be running a vulnerable version of one of the affected ShapedPlugin plugins with the backdoor code present.CVE-2026-49777.py:449-452

Observed behavior

  • Detects backdoor indicators by checking for fake plugin directories, known IOC file paths, and a specific HTTP response header (X-Cache-Status).CVE-2026-49777.py:91-125
  • Bypasses WordPress login by sending a hardcoded MD5 hash as the password to wp-login.php.CVE-2026-49777.py:130-167
  • Writes a PHP webshell to the uploads directory via a POST request to a backdoored REST API endpoint (/wp-json/wc/v3/settings/apply).CVE-2026-49777.py:172-199
  • Executes arbitrary OS commands by sending a base64-encoded command to a backdoored diagnostics file or by injecting a command into the X-Forwarded-For header.CVE-2026-49777.py:204-261
  • Exfiltrates sensitive data including wp-config.php contents, database credentials, and checks for Adminer and file manager access.CVE-2026-49777.py:266-321
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
Multi-step exploit targeting CVE-2026-49777 and CVE-2026-10735The script implements a documented attack chain (IOC detection, login bypass, REST API backdoor, webshell RCE, data exfiltration) against vulnerable WordPress plugins. This is normal exploit behavior, not a backdoor against the user.CVE-2026-49777.py:50-66CVE-2026-49777.py:88-125CVE-2026-49777.py:127-167CVE-2026-49777.py:169-199CVE-2026-49777.py:201-261CVE-2026-49777.py:263-321
Hardcoded Credentials
MD5 hash e268c35a06d85f672e70c9beecb4e5d1Used as a login bypass token and REST API auth token against the target. This is part of the documented exploit, not a credential that harms the PoC runner.CVE-2026-49777.py:51
Output File
pwned.txtThe script saves successful exploitation results locally. This is expected logging for an exploit tool and does not exfiltrate data from the runner's machine.CVE-2026-49777.py:46CVE-2026-49777.py:82-86
Contact Information
Telegram: https://t.me/toolsandpocDisplayed in the banner and README. This is author contact information, not executable behavior.CVE-2026-49777.py:42README.md:2
Review boundaries

What the analysis did not establish

  • Evidence includes only the Python script and README; the repository contains one non-text file (likely an image) that was not analyzed.
  • The script's actual effectiveness or safety is not verified; classification is based solely on code intent and structure.
  • One non-text media file (82730 bytes) was present in the repository but was not analyzed; its content is unknown.
  • The review is limited to the supplied text evidence; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2