Nxploited/CVE-2026-3891

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Multi-threaded Python script that exploits CVE-2026-3891 by requesting a nonce via an unauthenticated AJAX action, then uploading an arbitrary local file (e.g., a web shell) through the vulnerable lkn_pix_for_woocommerce_c6_save_settings endpoint. It constructs the resulting shell URL and saves it to a file.

Backdoor review

No backdoor observed in reviewed code

The PoC script CVE-2026-3891.py exploits CVE-2026-3891 by uploading a user-supplied shell file to a predictable path on a vulnerable WordPress site. It performs only the advertised exploit steps: nonce retrieval, file upload, and shell URL reporting. No hidden, deceptive, or unrelated harmful behavior is present in the reviewed text.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareWordPressPix for WooCommerce plugin
Attack typesarbitrary file uploadremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads a user-supplied file to a target server by exploiting the missing capability check and file type validation in the vulnerable AJAX handler. It does not merely detect the vulnerability; it performs the file upload and reports the resulting shell URL, which constitutes exploitation.

CVE-2026-3891.py:196-268README.md:25-27

Requirements

  • Target WordPress site running vulnerable Pix for WooCommerce plugin (<=1.5.0).README.md:11-16
  • Local shell file (e.g., shell.php) present in the script's working directory.CVE-2026-3891.py:103-108

Observed behavior

  • Sends POST to wp-admin/admin-ajax.php with action=lkn_pix_for_woocommerce_generate_nonce to obtain a nonce.CVE-2026-3891.py:147-193
  • Sends multipart POST to wp-admin/admin-ajax.php with action=lkn_pix_for_woocommerce_c6_save_settings, attaching the local shell file as certificate_crt_path and certificate_key_path.CVE-2026-3891.py:196-268
  • Constructs the uploaded shell URL at /wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/<shellname>.php.CVE-2026-3891.py:271-288
  • Appends the constructed shell URL to shells.txt and displays a success card.CVE-2026-3891.py:130-135CVE-2026-3891.py:291-318
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Script uploads a user-provided local file (shell.php) to the target server via the vulnerable AJAX endpoint.This is the expected exploit behavior for CVE-2026-3891, an arbitrary file upload vulnerability.CVE-2026-3891.py:196-268
Output File
shells.txtThe script appends successfully uploaded shell URLs to shells.txt for operator convenience. This is a standard post-exploitation logging mechanism.CVE-2026-3891.py:130-135
Author Contact
Telegram: @Kxploit, Channel: https://t.me/KNxploitedContact information is present in the README and script header but does not constitute backdoor behavior.README.md:29-30
Review boundaries

What the analysis did not establish

  • Evidence includes only two of four repository files; two text files (likely shell examples) are omitted.
  • The local shell file content is not provided, so the exact payload is unknown.
  • No network traffic or execution output is included to confirm successful exploitation.
  • Two text files (CVE-2026-3891.py and README.md) were reviewed. Two additional files in the repository were omitted from the evidence packet and not analyzed.
  • The script's behavior depends on a user-supplied shell file; the content of that file is not part of this artifact and was not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1