xxconi/CVE-2026-27384

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2026-27384 targeting W3 Total Cache <= 2.9.1. It injects crafted HTML comments containing PHP code via WordPress comment forms or REST API, bypasses the mfunc security token using a missing space and regex metacharacter, and triggers eval() execution through page caching to achieve unauthenticated remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script (CVE-2026-27384.py) and a README.md for CVE-2026-27384, targeting a known vulnerability in W3 Total Cache. The code performs vulnerability detection, payload injection via comment forms or REST API, and output extraction. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload aimed at the operator was observed. The script's behavior is consistent with a public proof-of-concept exploit for the stated CVE.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareW3 Total CacheWordPress
Attack typesremote code executioncode injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively injects malicious payloads into a target WordPress site and triggers remote code execution. It does not merely detect the vulnerability; it performs the full exploit chain including payload generation, injection, cache triggering, and output extraction.

CVE-2026-27384.py:495-609

Requirements

  • Target must have W3 Total Cache <= 2.9.1 installed and active with page caching enabled.CVE-2026-27384.py:225-268
  • Target must have a WordPress post with comments open (HTML form or REST API).CVE-2026-27384.py:274-318
  • W3TC_DYNAMIC_SECURITY token must contain a regex metacharacter (e.g., '.').README.md:40

Observed behavior

  • Detects W3 Total Cache installation and version via readme.txt, HTML, and headers.CVE-2026-27384.py:225-268
  • Locates a WordPress post with an open comment form or accessible REST API endpoint.CVE-2026-27384.py:274-318
  • Generates 64 payload variants using different PHP execution functions, bypass characters, and encoding.CVE-2026-27384.py:334-363
  • Injects payloads as WordPress comments via REST API or HTML form.CVE-2026-27384.py:369-406
  • Triggers page caching by making multiple HTTP requests to the post URL, causing the injected PHP to be evaluated.CVE-2026-27384.py:416-421
  • Extracts command output from the cached page using regex patterns.CVE-2026-27384.py:431-488
  • Supports bulk scanning of multiple targets with multi-threading.CVE-2026-27384.py:614-659
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script detects W3 Total Cache, injects PHP code via WordPress comments, triggers cache to achieve RCE, and extracts command output.This is the expected behavior of a PoC for CVE-2026-27384 and does not indicate a backdoor.CVE-2026-27384.py:495-609
Network Activity
The script sends HTTP requests to the target WordPress site for detection, injection, and cache triggering.All network activity is directed at the user-supplied target; no external or unrelated endpoints are contacted.CVE-2026-27384.py:186-208
Payload Generation
Payloads are generated using PHP functions shell_exec, system, passthru, exec with base64 encoding and bypass characters.These are standard RCE payloads for the described vulnerability; no hidden or unrelated commands are embedded.CVE-2026-27384.py:329-363
Review boundaries

What the analysis did not establish

  • Evidence includes only two text files (exploit script and README); a third file (likely requirements.txt) is omitted as non-text media.
  • The exploit code is not executed; classification is based on static analysis of the provided source code.
  • The README describes a separate scanner script (w3tc_rce.py) that is not included in the evidence, so analysis is limited to the provided CVE-2026-27384.py.
  • One non-text media file (36371 bytes) was present in the repository but not analyzed; its metadata suggests it is a non-executable image and it is not referenced by the reviewed scripts.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1