Nxploited/CVE-2026-27542-CVE-2026-27540-

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2026-27540 (arbitrary file upload) and CVE-2026-27542 (privilege escalation) in the WooCommerce Wholesale Lead Capture WordPress plugin. Mode 1 uploads a PHP web shell via an unauthenticated AJAX endpoint and brute-forces the upload directory to achieve remote code execution. Mode 2 registers a new user with administrator privileges via role injection and verifies admin access.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC script and README describe and implement two exploit modes (arbitrary file upload and privilege escalation) targeting the stated CVE-2026-27540 and CVE-2026-27542 vulnerabilities. All behavior is consistent with the advertised exploit functionality: uploading a user-supplied shell file, brute-forcing the upload directory, registering a user with administrator role injection, and verifying admin access. No concealed backdoor, unrelated payload, credential exfiltration, persistence mechanism, or operator-directed harm beyond the declared exploit was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareWooCommerce Wholesale Lead Capture (WordPress plugin)
Attack typesarbitrary file uploadprivilege escalationremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively sends crafted HTTP requests to vulnerable endpoints to upload a web shell (Mode 1) and create an administrator account (Mode 2), which constitutes exploitation rather than mere detection or scanning. The README explicitly describes it as a 'Proof-of-Concept (PoC) exploitation script'.

CVE-2026-2754 CVE-2026-27540.py:306-362CVE-2026-2754 CVE-2026-27540.py:677-733README.md:54

Requirements

  • Target WordPress site running vulnerable WooCommerce Wholesale Lead Capture plugin (<= 2.0.3.1).README.md:31README.md:48
  • For Mode 1, a PHP web shell file must be provided locally.CVE-2026-2754 CVE-2026-27540.py:314-316README.md:138

Observed behavior

  • Mode 1 sends an unauthenticated multipart POST request to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler to upload an arbitrary file, including a PHP web shell.CVE-2026-2754 CVE-2026-27540.py:312-327CVE-2026-2754 CVE-2026-27540.py:330-331
  • Mode 1 brute-forces the dynamically generated wwlc-temp-* upload directory using pattern-based, time-based, and random hex guesses to locate and access the uploaded shell.CVE-2026-2754 CVE-2026-27540.py:396-426CVE-2026-2754 CVE-2026-27540.py:429-450CVE-2026-2754 CVE-2026-27540.py:473-563
  • Mode 2 sends an unauthenticated POST request to /wp-admin/admin-ajax.php?action=wwlc_create_user with injected wp_capabilities[administrator]=1 to create a new administrator account.CVE-2026-2754 CVE-2026-27540.py:691-709CVE-2026-2754 CVE-2026-27540.py:719-720
  • Mode 2 attempts to log in with the newly created administrator credentials and verifies admin panel access by checking multiple WordPress admin endpoints.CVE-2026-2754 CVE-2026-27540.py:802-803CVE-2026-2754 CVE-2026-27540.py:174-227
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Mode 1 uploads a user-supplied shell file via the wwlc_file_upload_handler AJAX endpoint and brute-forces the wwlc-temp-* folder to locate it.This is the advertised arbitrary file upload exploit for CVE-2026-27540.CVE-2026-2754 CVE-2026-27540.py:306-362CVE-2026-2754 CVE-2026-27540.py:473-563
Exploit Behavior
Mode 2 registers a new user with administrator capabilities via the wwlc_create_user AJAX endpoint and verifies admin access.This is the advertised privilege escalation exploit for CVE-2026-27542.CVE-2026-2754 CVE-2026-27540.py:677-733CVE-2026-2754 CVE-2026-27540.py:736-812
Fixed Credential
Hardcoded password 'Nx_admin123@!SA' used for registration in Mode 2.The password is fixed and displayed to the user; it is used for the attacker-created account, not for surreptitious access.CVE-2026-2754 CVE-2026-27540.py:874-875
Output File
Results written to scan_results/wwlc_uploads.txt, scan_results/wwlc_shells_found.txt, scan_results/wwlc_register_results.txt, scan_results/Admin_login.txt.These files log exploit outcomes locally; no exfiltration to a remote server is performed.CVE-2026-2754 CVE-2026-27540.py:586-606CVE-2026-2754 CVE-2026-27540.py:788-810
Review boundaries

What the analysis did not establish

  • One file (requirements.txt) was omitted from the evidence; its content is not available for analysis.
  • The evidence includes only the Python script and README; no shell.php example or target list is provided.
  • The analysis is based solely on static code review; the code was not executed, and its operational reliability is not verified.
  • One file (1505 bytes) was classified as unclassified and omitted from the text evidence; its content was not reviewed.
  • Binary files were flagged as metadata-only and not analyzed; no binary content was inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2