Nxploited/CVE-2026-1555

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2026-1555, an unauthenticated arbitrary file upload vulnerability in the WebStack WordPress theme, by sending a POST request with a user-supplied payload to the vulnerable `img_upload` AJAX endpoint and extracting the uploaded file's URL from the response.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward multi-threaded exploit for CVE-2026-1555. It uploads a user-supplied file to a vulnerable WordPress endpoint and logs successful URLs. No backdoor, concealed payload, or operator-directed harm was observed in the reviewed text.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareWebStack WordPress Theme
Attack typesArbitrary File UploadRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a crafted request to upload an arbitrary file to a vulnerable endpoint, which is the definition of an exploit. It does not merely check for the vulnerability's presence; it performs the upload and extracts the resulting URL for subsequent access.

CVE-2026-1555.py:175-225README.md:12-14

Requirements

  • A target running a vulnerable version of the WebStack theme (<= 1.2024).README.md:31
  • A local file (e.g., a PHP webshell) to upload.CVE-2026-1555.py:105-107

Observed behavior

  • Sends a multipart POST request to /wp-admin/admin-ajax.php with action=img_upload and the user-specified file.CVE-2026-1555.py:186-201
  • Parses the JSON response to extract the uploaded file's URL from the 'data.src' field.CVE-2026-1555.py:205-223
  • Writes the extracted shell URL to an output file (uploaded_paths.txt).CVE-2026-1555.py:160-163
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Uploads a user-supplied file to /wp-admin/admin-ajax.php via the img_upload actionThis is the documented exploit for CVE-2026-1555 and matches the vulnerability description.CVE-2026-1555.py:175-201
Output File
uploaded_paths.txtSuccessful shell URLs are appended to this file for later use.CVE-2026-1555.py:160-163
Network Behavior
Disables SSL verification and sets NO_PROXY=*Common in PoC tools to avoid connection issues; does not indicate backdoor activity.CVE-2026-1555.py:20-21
Review boundaries

What the analysis did not establish

  • One file (license) was omitted from the text analysis, but it is unlikely to change the classification.
  • The evidence does not include the execution of the code; classification is based solely on static analysis of the provided source.
  • One file (shell.php) was classified as binary and not analyzed; it is a user-provided payload, not part of the PoC tool itself.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1