webshellseo8/CVE-2026-32488-POC

GitHubRepository PoCWriteup

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README.md file describing a tool for mass scanning and exploiting CVE-2026-32488 in the UpdraftPlus WordPress plugin. It contains no exploit or scanner code; it only provides a high-level overview, usage instructions, and output descriptions.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists solely of a README.md file describing a mass scanner and exploit tool for CVE-2026-32488. The file contains no executable code, no obfuscated payloads, and no instructions for the reviewer to perform harmful actions. It describes normal exploit behavior against the stated target (WordPress User Registration plugin) and includes standard disclaimers. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesMarkdown
Target softwareUpdraftPlus WordPress plugin
Attack typesPrivilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The only file provided is a README.md that describes a tool's features and usage but contains no executable code, exploit logic, or scanner implementation. It is a substantive technical writeup describing the tool's purpose and operation.

README.md:1-59

Requirements

  • Target list of URLs in targets.txtREADME.md:22-23
  • Python 3 and dependencies from requirements.txtREADME.md:41-45

Observed behavior

  • Describes mass scanning of target lists with concurrent workersREADME.md:13
  • Describes auto-exploitation of CVE-2026-32488README.md:14
  • Describes credential and role extraction (admin, file-manager, uploader accounts)README.md:15
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Contact Information
Telegram: @WebshellSR, Website: https://webshell.store/The README includes contact details for the author, which may be associated with webshell-related activity, but this alone does not constitute backdoor behavior in the reviewed artifact.README.md:54-55
Review boundaries

What the analysis did not establish

  • Only the README.md file is included; the actual Python script (CVE-2026-32488 -mass.py) and requirements.txt are not present.
  • The artifact describes a tool for UpdraftPlus, but the associated CVE context indicates the vulnerability is in the User Registration plugin, creating a discrepancy in target software.
  • Only the README.md file was provided; no source code, scripts, or binary files were included in the evidence packet. The actual behavior of the referenced tool cannot be assessed.
  • The analysis scope indicates that no executable source was identified and binary files were not analyzed, so the review is limited to the documentation text.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1