xxconi/CVE-2026-6960

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-6960, an unauthenticated arbitrary file upload vulnerability in BookingPress Pro <= 5.6, by uploading a PHP web shell via a data URI in a signature custom field and then verifying remote code execution.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward exploit for CVE-2026-6960. It uploads a PHP web shell via a data URI in a signature field, then verifies execution. No concealed backdoor, unrelated payload, or deceptive behavior was observed. The shell code is clearly disclosed and its purpose is consistent with the stated vulnerability.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareBookingPress Pro WordPress Plugin
Attack typesArbitrary File UploadRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively uploads a PHP web shell to a target server and then executes commands on it, which constitutes exploitation, not just detection or scanning.

CVE-2026-6960.py:38CVE-2026-6960.py:187-225CVE-2026-6960.py:231-247

Requirements

  • A signature-type custom field must be configured in the BookingPress booking form by the site admin.CVE-2026-6960.py:274-275
  • At least one active service must exist to generate a valid timeslot.README.md:39
  • A page with the BookingPress booking form widget must be publicly accessible.README.md:40

Observed behavior

  • Fetches a WordPress nonce from a booking page.CVE-2026-6960.py:57-85
  • Fetches a timeslot transient key via an AJAX request.CVE-2026-6960.py:91-133
  • Fetches a pre-booking verification token via an AJAX request.CVE-2026-6960.py:139-181
  • Uploads a PHP web shell by sending a data URI in the 'bookingpress_signature_field' parameter to the 'bookingpress_book_appointment_booking' AJAX action.CVE-2026-6960.py:187-225
  • Verifies remote code execution by requesting the uploaded shell with a 'cmd' parameter and checking for command output.CVE-2026-6960.py:231-247
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Web Shell Payload
<?php if(isset($_GET["cmd"])){ echo "<pre>".shell_exec($_GET["cmd"])."</pre>"; } ?>The PoC deploys a simple PHP web shell to demonstrate RCE, which is the expected outcome of the described arbitrary file upload vulnerability.CVE-2026-6960.py:38
Exploit Flow
Multi-step unauthenticated chain: fetch nonce, fetch timeslot transient, fetch pre-booking token, upload shell via data URI, verify shell execution.The entire exploit flow is dedicated to exploiting the CVE-2026-6960 vulnerability. No steps perform unrelated actions.CVE-2026-6960.py:57-247
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied text files; no binary or opaque content was present.
  • The artifact's behavior is inferred from static analysis of the source code; the code was not executed.
  • The README.md file describes a v2 correction based on community feedback, but the evidence does not include the v1 code for comparison.
  • Only the two text files (CVE-2026-6960.py and README.md) were reviewed. No binary files were present in the evidence packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1