shinthink/CVE-2026-15282
PoC files
4 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact is a Python-based mass exploitation tool for CVE-2026-15282. It detects vulnerable WordPress Instant Appointment plugin instances and exploits an unauthenticated arbitrary file upload vulnerability to deploy a PHP webshell, achieving remote code execution.
Backdoor review
No backdoor observed in reviewed code
The PoC exploit for CVE-2026-15282 performs only the documented vulnerability exploitation: detecting the vulnerable plugin, uploading a PHP webshell via the unauthenticated AJAX handler, verifying RCE, and optionally cleaning up the shell. No concealed backdoor, unrelated payload, or deceptive behavior was observed in the supplied Python script or README.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script that actively exploits CVE-2026-15282 by uploading a PHP webshell to a vulnerable target and executing commands on it. The README explicitly describes it as a 'Mass RCE Exploit' and provides usage examples for exploitation. The code contains functions to detect, exploit, verify RCE, and clean up, which is characteristic of an exploit.
README.md:8cve_2026_15282.py:121-167cve_2026_15282.py:169-175Requirements
- Target must have the vulnerable Instant Appointment plugin (<= 1.2) installed and the 'add_service_front' AJAX action accessible.
cve_2026_15282.py:100-119 - The target server must allow outbound HTTP requests (for file_get_contents) or support data:// URIs.
README.md:34-38
Observed behavior
- Detects the presence of the Instant Appointment plugin by requesting known plugin paths and checking for the 'add_service_front' AJAX action.
cve_2026_15282.py:100-119 - Exploits the vulnerability by sending a POST request to /wp-admin/admin-ajax.php with a base64-encoded PHP webshell payload in the 'image_url' parameter and a .php filename in the 'image_name' parameter.
cve_2026_15282.py:121-167 - Verifies remote code execution by requesting the uploaded webshell with a system command ('id') and checking for the expected output.
cve_2026_15282.py:169-175 - Optionally cleans up by deleting the uploaded webshell via a self-deletion command.
cve_2026_15282.py:177-180 - Supports mass scanning of multiple targets from a file with multi-threading and progress reporting.
cve_2026_15282.py:227-288
Behaviors behind the backdoor verdict
Observables
- Webshell Upload
- PHP code: '<?php echo "S|";system($_GET["c"]." 2>&1");echo "|E";'The exploit uploads a simple PHP webshell to the target server to demonstrate RCE, consistent with the described CVE.
cve_2026_15282.py:124 - Cleanup Mechanism
- self._delete_shell() method and --no-cleanup flagThe script includes a cleanup mechanism that deletes the uploaded webshell after exploitation, unless the user explicitly opts out with --no-cleanup. This is standard for responsible PoC scripts.
cve_2026_15282.py:177-180cve_2026_15282.py:210-212cve_2026_15282.py:309 - Output Saving
- Saves RCE URLs to a user-specified fileThe script can save discovered RCE URLs to a file for later use, a common feature in mass exploitation tools.
cve_2026_15282.py:273-275
What the analysis did not establish
- One file (metadata only) was omitted from the evidence packet, but all readable text files are complete. The analysis is based solely on the provided source code and documentation; the code was not executed.
- One file (metadata only, 70 bytes) was not included in the text analysis; its content is unknown but its small size and non-text classification make a backdoor payload unlikely.
- The review is limited to the supplied static text; runtime behavior or external dependencies were not executed or analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.