shinthink/CVE-2026-39492

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python-based mass scanner for CVE-2026-39492, an unauthenticated blind SQL injection vulnerability in the WP Maps WordPress plugin. It detects the plugin, checks the version, and uses time-based blind SQLi payloads to confirm vulnerability. It includes an optional data extraction feature for admin credentials but primarily functions as a detection and validation tool.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python-based scanner and proof-of-concept for CVE-2026-39492, a blind SQL injection vulnerability in the WP Maps plugin. The code performs version detection, time-based blind SQLi testing, and optional credential extraction via the described vulnerability. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload targeting the operator was observed. The behavior is consistent with a legitimate security research tool.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareWP Maps (wp-google-map-plugin)
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary operation of the code is to detect and confirm the presence of the vulnerability through time-based blind SQLi probes, not to exploit it for unauthorized access or data exfiltration by default. The README and script describe it as a 'scanner' and 'mass scanner', and the core logic focuses on detection and validation. The optional --extract flag adds data extraction capability, but the default and primary behavior is scanning.

README.md:8cve_2026_39492.py:3cve_2026_39492.py:140-230cve_2026_39492.py:528

Requirements

  • Target must have WP Maps plugin <= 4.9.1 installed and the admin-ajax.php endpoint reachable.cve_2026_39492.py:84-118cve_2026_39492.py:370-398

Observed behavior

  • Detects WP Maps plugin by fetching readme.txt or plugin PHP file and searching for identifying markers.cve_2026_39492.py:84-118
  • Checks if the detected plugin version is vulnerable (<= 4.9.1).cve_2026_39492.py:120-136
  • Sends time-based blind SQLi payloads using backtick-wrapped location_id parameter to admin-ajax.php and measures response time to confirm vulnerability.cve_2026_39492.py:140-230
  • Optionally extracts data (e.g., admin credentials) from confirmed vulnerable targets using boolean-based blind SQLi with binary search.cve_2026_39492.py:250-301cve_2026_39492.py:576-588
  • Supports mass scanning of multiple targets from a file with configurable threads and output of vulnerable hosts.cve_2026_39492.py:420-508
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Scanner
cve_2026_39492.pyThe main Python script implements detection and exploitation of CVE-2026-39492, including mass scanning and blind SQLi data extraction.cve_2026_39492.py:1-600
Network Activity
HTTP requests to target WordPress sitesThe script sends POST requests to /wp-admin/admin-ajax.php with crafted location_id payloads to test and exploit the SQL injection vulnerability.cve_2026_39492.py:140-230
Data Extraction
Admin credentials extraction via blind SQLiThe --extract flag triggers extraction of admin user_login and user_pass from the WordPress database using the SQL injection vulnerability.cve_2026_39492.py:576-588
Review boundaries

What the analysis did not establish

  • One file (unclassified, 70 bytes) was omitted from the packet; its content is unknown but unlikely to change classification given the complete coverage of the main script and README.
  • The analysis is based solely on static review of the provided source code; no dynamic execution or verification of the vulnerability was performed.
  • One unclassified file (70 bytes) was present in the repository but not analyzed; its content is unknown.
  • The review is limited to the supplied text evidence and does not include dynamic analysis or execution of the code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1