xxconi/2026-11551

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2026-11551 targeting the Branda WordPress plugin (<=3.4.29). It performs unauthenticated privilege escalation by overwriting arbitrary user passwords via the plugin's password_1 field during registration or signup flows, then verifies the takeover by logging in and checking admin access.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python PoC script for CVE-2026-11551. The script performs automated exploitation of a known WordPress plugin vulnerability (privilege escalation via account takeover) and includes post-exploitation reconnaissance (listing users and plugins). No concealed backdoor, unrelated payload, or deceptive behavior targeting the PoC operator was observed. The script's actions are consistent with its stated purpose of demonstrating the vulnerability.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareBranda – White Label & Branding, Free Login Page CustomizerWordPress
Attack typesprivilege escalationaccount takeoverauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted HTTP requests to overwrite user passwords and then logs in to gain unauthorized access, which constitutes exploitation, not mere detection or scanning.

cve_2026_11551.py:205-254cve_2026_11551.py:422-561cve_2026_11551.py:600-770

Requirements

  • Target must run Branda plugin version <= 3.4.29 with registration or multisite signup enabled.cve_2026_11551.py:3-5cve_2026_11551.py:135-173
  • For single-site vector, user registration must be open and the password_1 field must be present.cve_2026_11551.py:168-173
  • For multisite vector, the target must be a WordPress multisite installation with signup enabled.cve_2026_11551.py:161-165

Observed behavior

  • Reconnaissance: detects Branda version, multisite status, registration openness, presence of password_1 field, and enumerates users via REST API and author archives.cve_2026_11551.py:135-199
  • Vector A (single-site): POSTs to wp-login.php?action=register with an existing username and attacker-chosen password_1, causing the vulnerable hook to immediately overwrite the user's password.cve_2026_11551.py:205-254
  • Vector B (multisite): POSTs to wp-signup.php to store password_1 in signup meta, then activates the signup via wp-activate.php to trigger the password overwrite.cve_2026_11551.py:260-330
  • Vector C (reset abuse): attempts to inject password_1 into the lostpassword flow as an alternative attack path.cve_2026_11551.py:367-392
  • Verification: logs in with the new password, confirms authenticated session, checks for admin dashboard access, and determines the user's role.cve_2026_11551.py:422-561
  • Post-exploitation: enumerates users and installed plugins using the compromised session.cve_2026_11551.py:567-594
  • Mass scanning: supports multi-threaded scanning of a target list from a file.cve_2026_11551.py:855-904
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Post Exploitation Reconnaissance
The script includes a post_exploit function that lists users and plugins after a successful takeover.This is expected behavior for a PoC demonstrating the impact of the vulnerability, not a backdoor targeting the operator.cve_2026_11551.py:567-595
Credential Saving
Successful takeovers are saved to a local file (branda_results.txt) including the target URL, username, password, role, and cookies.This is standard logging for a security testing tool and does not exfiltrate data to a remote server.cve_2026_11551.py:96-107
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied text files; no runtime behavior or external network interactions were observed.
  • The artifact's complete_artifact_coverage is false, indicating the repository snapshot may contain additional files not included in the evidence packet.
  • Only the two text files (README.md and cve_2026_11551.py) were provided; no binary files or other repository content were inspected.
  • The review does not assess the safety of executing the script against authorized targets, only whether the script itself contains a backdoor or deceptive payload aimed at the operator.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1