xxconi/CVE-2026-6741

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that automates the full privilege escalation chain for CVE-2026-6741, including agent login, admin user ID discovery, customer-to-admin linking via the vulnerable ability, password reset triggering, and admin login verification. The script is designed to be executed against a target WordPress site to achieve administrator takeover.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script (CVE-2026-6741.py) and a README.md documentation file for CVE-2026-6741. The script automates a privilege escalation attack against a specific WordPress plugin (LatePoint <= 5.4.1) by linking a customer record to an administrator account and then resetting the administrator's password. All observed behavior is consistent with the stated exploit purpose: it performs HTTP requests to the target WordPress site to log in, enumerate users, call the vulnerable ability endpoint, trigger password resets, and verify admin access. No concealed backdoor, unrelated payload, credential exfiltration to an external party, persistence mechanism, or deceptive behavior was found. The script's output and file operations are limited to local result reporting and saving to a user-specified file. The README provides documentation and manual curl-based PoC steps that match the script's logic.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwareLatePoint – Calendar Booking Plugin for Appointments and EventsWordPress
Attack typesPrivilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively exploits the vulnerability by sending HTTP requests to perform the entire privilege escalation chain, including linking a customer to an admin account and changing the admin's password. It is not merely a scanner; it executes the exploit steps to achieve administrator takeover.

CVE-2026-6741.py:619-759CVE-2026-6741.py:1-21

Requirements

  • Valid credentials for a WordPress user with the latepoint_agent role.CVE-2026-6741.py:19
  • Target WordPress site running LatePoint plugin version <= 5.4.1 and WordPress 6.9+ with Abilities API enabled.CVE-2026-6741.py:17-18
  • A LatePoint customer record controlled by the attacker.CVE-2026-6741.py:20

Observed behavior

  • Authenticates to WordPress using provided agent credentials and retrieves a REST API nonce.CVE-2026-6741.py:60-117
  • Discovers administrator WordPress user IDs via REST API and author page enumeration.CVE-2026-6741.py:171-249
  • Sends a POST request to the vulnerable connect-customer-to-wp-user ability endpoint to link a customer record to an administrator's WordPress user ID.CVE-2026-6741.py:304-380
  • Triggers the LatePoint password reset flow for the linked customer, which sends a reset email.CVE-2026-6741.py:386-434
  • Completes the password reset using a provided token, which changes the administrator's WordPress password.CVE-2026-6741.py:440-490
  • Logs in as the administrator with the new password and verifies administrative access.CVE-2026-6741.py:496-554
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Automated privilege escalation via LatePoint connect-customer-to-wp-user ability and password reset flowThe script performs the exact attack chain described in the CVE: agent login, admin user ID discovery, customer-to-admin linking, password reset initiation, and admin login verification. This is the intended exploit behavior, not a backdoor.CVE-2026-6741.py:619-759
Network Target
User-supplied target WordPress siteAll network requests are directed to the target specified by the user via -u/--url or -l/--list. No hardcoded external C2 or exfiltration endpoints are present.CVE-2026-6741.py:619-636
File Output
Local result file (default: privesc_results.txt)The script writes JSON results and a summary line to a local file specified by the user. This is standard operational output for a security scanner, not a persistence or data-hiding mechanism.CVE-2026-6741.py:781-787CVE-2026-6741.py:898-901
Review boundaries

What the analysis did not establish

  • The evidence includes a README.md file with manual exploitation steps and technical analysis, but the primary artifact is the Python exploit script.
  • The script requires a manual step to obtain the password reset token from email, but it automates all other exploitation steps.
  • Only the two text files (CVE-2026-6741.py and README.md) were provided and reviewed. No binary files or other repository content were inspected.
  • The review does not assess whether the exploit works as claimed or whether the target plugin is actually vulnerable.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1