Nxploited/CVE-2026-4484

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2026-4484 in the Masteriyo LMS WordPress plugin by sending a crafted REST API request to escalate a Student-level user's privileges to Administrator. It supports two modes: registering a new user then escalating, or escalating an existing user. After escalation, it verifies admin access and writes successful credentials to a file.

Backdoor review

No backdoor observed in reviewed code

The PoC script performs privilege escalation against a known vulnerable WordPress plugin endpoint. It registers or logs in, extracts a nonce, sends a role-update request, and verifies admin access. No concealed executable behavior, unrelated payload, credential exfiltration, persistence, or operator-directed harm was observed. The script writes confirmed admin credentials to a local file as documented.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesPython
Target softwareMasteriyo LMSWordPress
Attack typesprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional Python script that actively exploits CVE-2026-4484 by sending a crafted POST request to the vulnerable REST API endpoint to change a user's role to 'administrator'. It performs the complete attack chain: registration (optional), login, privilege escalation, and verification of admin access. The README explicitly describes it as a 'Proof-of-Concept (PoC) exploitation script'.

CVE-2026-4484.py:507-546README.md:42

Requirements

  • A target WordPress site running Masteriyo LMS version <= 2.1.6README.md:30
  • For Nx_1 mode: target site must have open registration enabledCVE-2026-4484.py:411-475
  • For Nx_2 mode: valid Student-level or higher credentials for the target siteCVE-2026-4484.py:612-641

Observed behavior

  • Registers a new user account on the target WordPress site via the Masteriyo signup formCVE-2026-4484.py:411-475
  • Logs in to the target site using the Masteriyo AJAX login endpointCVE-2026-4484.py:345-405
  • Extracts the user ID and a nonce from the Masteriyo dashboard pageCVE-2026-4484.py:481-505
  • Sends a POST request to /wp-json/masteriyo/v1/users/instructors/{user_id} with payload {"roles": ["administrator"]} to escalate privilegesCVE-2026-4484.py:507-546
  • Re-authenticates with a fresh session and verifies admin access by checking /wp-admin/ pagesCVE-2026-4484.py:602-610
  • Writes successfully escalated credentials to Login_admin.txt in the format 'https://site.com/wp-login.php user:email|pass:password'CVE-2026-4484.py:552-569
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Privilege escalation via POST to /wp-json/masteriyo/v1/users/instructors/{user_id} with payload {"roles": ["administrator"]}This is the documented exploit for CVE-2026-4484. The script performs exactly this action to elevate a student account to administrator.CVE-2026-4484.py:521-524
Output File
Login_admin.txtThe script writes successful admin credentials to this local file in the format 'https://site.com/wp-login.php user:email|pass:password'. This is the documented output and does not exfiltrate data.CVE-2026-4484.py:552-569
Admin Verification
verify_admin_access_sync and verify_plugin_installation_access_sync functionsAfter escalation, the script re-authenticates and checks for admin dashboard and plugin installation access to confirm the privilege escalation succeeded. This is part of the PoC verification, not a backdoor.CVE-2026-4484.py:255-339
Review boundaries

What the analysis did not establish

  • One file (requirements.txt) was omitted from the evidence packet; its content is not available for analysis.
  • The evidence packet reports complete_artifact_coverage as false, indicating not all repository files were included.
  • One file (requirements.txt) was omitted from the text evidence; its content is not reviewed.
  • Binary files were flagged as metadata-only and not analyzed; none were identified in the artifact.
  • The review does not assess the safety or legality of using this PoC against unauthorized targets.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1