CVE-2026-4350 Exploit Metadata

PoC files

11 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Technical assessment

The artifact contains a Nuclei template that checks for the presence of CVE-2026-4350 by sending a GET request with a path traversal payload to delete wp-config.php. It does not contain exploit code that exercises the vulnerability to achieve file deletion or site takeover; the template only detects the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Nuclei template for CVE-2026-4350. The README describes the vulnerability and provides commands to run an exploit and a PoC script, but neither script is included in the reviewed text. The Nuclei template contains a standard HTTP request for detecting the vulnerability. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed files.

ClassificationScanner

Model confidence95%

AuthenticationRequired

Languagesyaml

Target softwarePerfmatters WordPress plugin

Attack typespath traversalarbitrary file deletion

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Nuclei template (nuclei/cve-2026-4350.yaml) that defines a single HTTP request to check for the vulnerability. It does not contain code to exploit the vulnerability (e.g., to delete a file or take over the site); it only detects the presence of the vulnerable endpoint. The README references separate exploit and PoC scripts, but those files are not included in the evidence.

nuclei/cve-2026-4350.yaml:1-10README.md:13-17

Requirements

Target must be running a vulnerable version of the Perfmatters plugin (<= 2.5.9.1).README.md:11
Attacker must be authenticated with at least Subscriber-level access.nuclei/cve-2026-4350.yaml:1-10

Observed behavior

Sends an HTTP GET request to /wp-admin/admin-ajax.php with parameters action=perfmatters_delete and delete=../../../../wp-config.php.nuclei/cve-2026-4350.yaml:8-10

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Reference: python3 exploit/exploit.py http://targetThe README instructs the user to run an exploit script, but the script itself is not included in the evidence.README.md:14
Command Reference: bash poc/poc.sh http://targetThe README instructs the user to run a PoC script, but the script itself is not included in the evidence.README.md:17
Nuclei Template: GET {{BaseURL}}/wp-admin/admin-ajax.php?action=perfmatters_delete&delete=../../../../wp-config.phpThe Nuclei template contains a standard detection request for the CVE-2026-4350 path traversal vulnerability.nuclei/cve-2026-4350.yaml:8-10

Review boundaries

What the analysis did not establish

Only 2 of 11 files in the repository are included in the evidence. The README references exploit/exploit.py and poc/poc.sh, but these files are not provided, so their content cannot be analyzed.
The Nuclei template lacks authentication handling; it does not show how credentials are supplied, which is required to trigger the vulnerability.
Only 2 of 11 files in the repository were provided as text; 9 files were omitted. The referenced exploit/exploit.py and poc/poc.sh scripts are not included in the evidence and were not reviewed.
Binary files were flagged as metadata-only and not analyzed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

vulnerable-setup/docker-compose.yml

Created 2026-04-11Vuln labCVE-2026-4350Compose · images

1 Compose manifest · 1 service

Analysisdeepseek-v4-pro:cloud · 2026-08-13

Environment assessment

A single-service Docker Compose setup that runs a stock 'wordpress' image and maps container port 80 to host port 8080. The README describes it as the target for CVE-2026-4350, an arbitrary file deletion vulnerability in the Perfmatters WordPress plugin.

vulnerable-setup/docker-compose.yml:1-6README.md:1-4

Lab assessment

Vulnerability lab

The README explicitly states the environment is for CVE-2026-4350, describes the vulnerability, and provides exploit and PoC commands targeting the WordPress service defined in the Compose file. The Compose file itself is a minimal WordPress service declaration, consistent with a vulnerable target for the described plugin vulnerability.

README.md:1-4README.md:13-16

Lab shapeCompose · images

Services1

Compose manifests1

Dockerfiles0

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

wordpress

vulnerable target

A WordPress service based on the official 'wordpress' image, exposing port 80 on host port 8080. It is intended to host the vulnerable Perfmatters plugin for the CVE-2026-4350 exercise.

vulnerable-setup/docker-compose.yml:3-6README.md:3-4

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-4350

Insufficient evidence

The README claims CVE-2026-4350 is an arbitrary file deletion vulnerability in the Perfmatters plugin, but the packet contains no exploit code, PoC script, plugin files, or any technical detail that would allow verification of the vulnerability. The Compose file only declares a stock WordPress image without the plugin installed, so the association cannot be confirmed or contradicted from the supplied evidence.

README.md:3-4README.md:13-16

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose must be installed to run the environment.vulnerable-setup/docker-compose.yml:1-6
The vulnerable Perfmatters plugin (version <= 2.5.9.1) must be installed in the WordPress container, as the stock image does not include it.README.md:9-11
The exploit and PoC scripts referenced in the README (exploit/exploit.py, poc/poc.sh) must be present and executed against the target.README.md:13-16

Evidence-described exercise path

Start the vulnerable WordPress target using Docker Compose.vulnerable-setup/docker-compose.yml:1-6
Install the vulnerable Perfmatters plugin (<= 2.5.9.1) on the WordPress instance (not shown in the packet).README.md:9-11
Run the exploit script against the target: python3 exploit/exploit.py http://targetREADME.md:13-14
Run the PoC script against the target: bash poc/poc.sh http://targetREADME.md:15-16

Safety-review evidence

Behaviors behind the stored safety assessment

Insufficient evidence

The packet contains only a Compose file and a README. The Compose file is a minimal, non-privileged WordPress service with a port mapping. No exploit code, PoC scripts, or other executable artifacts are included. Without the actual exploit payloads, it is impossible to determine whether the exercise would cause harm beyond the intended lab target. The README disclaimer states 'Educational purposes only,' but no concrete behavior can be assessed.

vulnerable-setup/docker-compose.yml:1-6README.md:18-19

Review boundaries

What the analysis did not establish

The packet does not include the exploit script (exploit/exploit.py) or PoC script (poc/poc.sh), so their behavior cannot be analyzed.
The WordPress image is a stock image without the vulnerable Perfmatters plugin, so the environment is not directly runnable as a vulnerability lab without additional setup.
No CVE details beyond the README description are provided, preventing verification of the CVE association.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2026-4350