shinthink/CVE-2026-58480

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that attempts unauthenticated arbitrary file upload and remote code execution against WordPress sites running Blocksy Companion Pro < 2.1.47. It uploads a PHP webshell using a double-extension bypass (shell.woff2.php) via the save_attachments AJAX handler, then searches for and tests the uploaded shell.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README and a Python exploit script for CVE-2026-58480. The script uploads a PHP webshell to a vulnerable WordPress plugin and then searches for it. The payload is a simple command-execution webshell, consistent with the stated exploit goal. No concealed backdoor, credential theft, persistence, or unrelated payload was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareBlocksy Companion ProWordPress
Attack typesarbitrary file uploadremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete Python script (exploit.py) that actively uploads a PHP webshell to a target and attempts to execute commands on it, which is the definition of exploit code. The README describes it as an exploit and provides usage instructions for exploitation.

exploit.py:76-87exploit.py:146-196README.md:8README.md:85-86

Requirements

  • Target must run Blocksy Companion Pro < 2.1.47 with WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions active.README.md:26
  • Target must expose the vulnerable AJAX endpoint (wp-admin/admin-ajax.php) and allow unauthenticated requests.exploit.py:170-175

Observed behavior

  • Fingerprints the target for Blocksy theme or companion plugin and checks version.exploit.py:90-137
  • Generates a random filename with .woff2.php double extension to bypass strpos() validation.exploit.py:140-143
  • Sends a multipart POST request with a PHP webshell payload to multiple AJAX endpoints using the parameter blc-review-images[].exploit.py:146-196
  • Searches common upload paths for the uploaded shell and tests command execution via ?cmd=id.exploit.py:199-237
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Payload
<?php if(isset($_REQUEST['cmd'])){ system($_REQUEST['cmd']); } ?>The exploit uploads a PHP file that executes commands via the 'cmd' parameter. This is the expected behavior for an arbitrary file upload RCE exploit.exploit.py:76-87
Exploit Behavior
Uploads a file with double extension (e.g., .woff2.php) to bypass validation, then probes common paths to locate the uploaded shell.The script's actions are directly aligned with exploiting the described vulnerability. No additional hidden actions were found.exploit.py:146-196exploit.py:199-237
Review boundaries

What the analysis did not establish

  • Evidence is limited to the two text files provided; no binary or dependency files were inspected.
  • The artifact's behavior is inferred from static code analysis; the code was not executed.
  • The README references reconstructed PHP source code (line 37) that is not present in the evidence.
  • Only the two text files (README.md and exploit.py) were provided and reviewed. No binary files or other artifacts were present.
  • The review does not assess the safety or reliability of the exploit code, only the absence of backdoor behavior within the reviewed evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2