xxconi/CVE-2026-5718

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that automates the full exploitation chain for CVE-2026-5718, including nonce retrieval, form detection, non-ASCII filename bypass, PHP webshell upload, and remote command execution verification.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script (CVE-2026-5718.py) and a README.md documentation file for CVE-2026-5718. The Python script implements a scanner that exploits a known arbitrary file upload vulnerability in a WordPress plugin to upload a PHP webshell and verify remote code execution. The script's behavior is entirely consistent with the documented vulnerability: it retrieves a nonce, identifies vulnerable forms, uploads a PHP file using a non-ASCII filename bypass, and tests the uploaded shell. No concealed, deceptive, or unrelated harmful behavior was observed. The script does not contain persistence mechanisms, credential theft, unrelated payloads, or any actions beyond the described exploit chain. The README provides technical documentation and manual exploitation steps matching the script's logic.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespythonmarkdown
Target softwareDrag and Drop Multiple File Upload for Contact Form 7
Attack typesarbitrary file uploadremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script (CVE-2026-5718.py) that actively exploits the vulnerability by uploading a PHP webshell and executing commands on the target server. The README.md provides supporting documentation but the core artifact is functional exploit code.

CVE-2026-5718.py:1-3CVE-2026-5718.py:274-286CVE-2026-5718.py:411-437

Requirements

  • Target must have the vulnerable plugin (<= 1.3.9.6) installed and active with a CF7 form containing an [mfile] field configured with a custom blacklist-types attribute.README.md:178-182

Observed behavior

  • Retrieves a valid nonce by sending a request to the unprotected _wpcf7_check_nonce AJAX endpoint.CVE-2026-5718.py:96-171
  • Locates CF7 forms on the target site that contain file upload fields.CVE-2026-5718.py:198-268
  • Uploads a PHP webshell using a filename containing a non-ASCII character to bypass the wpcf7_antiscript_file_name() sanitization function.CVE-2026-5718.py:274-376
  • Constructs the URL of the uploaded webshell and verifies remote code execution by sending a command and checking the response for expected output.CVE-2026-5718.py:385-437
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Uploads a PHP webshell via the CVE-2026-5718 vulnerability and verifies RCEThe script's sole purpose is to exploit the documented vulnerability. It builds and uploads a PHP shell, then tests it with a user-specified command. This is normal exploit behavior for the stated target.CVE-2026-5718.py:274-355CVE-2026-5718.py:411-437
Shell Payload
PHP webshells using system, passthru, exec, assert, base64 eval, and a full fallback shellThe script includes multiple PHP shell payloads selectable by the user. These are standard one-liner webshells used for post-exploitation verification, not a backdoor targeting the PoC runner.CVE-2026-5718.py:74-90
Review boundaries

What the analysis did not establish

  • Evidence consists of two text files from a repository snapshot; no binary files or external dependencies were inspected.
  • The analysis is based solely on static review of the provided source code; the code was not executed or tested.
  • The README.md file contains manual exploitation steps and technical analysis, but the primary artifact for classification is the Python exploit script.
  • Only the two text files (CVE-2026-5718.py and README.md) were provided and reviewed. No binary files were present in the evidence packet.
  • The review does not assess the safety of executing the script against a live target, only whether the script itself contains backdoor behavior against the person running it.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1