xxconi/CVE-2026-5229

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based scanner that detects the Form Notify WordPress plugin, discovers target user emails, and attempts to exploit CVE-2026-5229 (LINE OAuth authentication bypass) via cookie injection or email matching. It reports whether authentication was successful but primarily functions as a detection and validation tool.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python scanner and a README for CVE-2026-5229, a WordPress authentication bypass. The Python script performs reconnaissance, sets a cookie, and simulates an OAuth callback to test the vulnerability. No concealed executable behavior, unrelated payload, persistence, or operator-directed harm was observed. The code is consistent with a legitimate proof-of-concept exploit for the stated CVE.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPythonMarkdown
Target softwareWordPressForm Notify Plugin
Attack typesAuthentication BypassAccount Takeover
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script (CVE-2026-5229.py) is a scanner that detects vulnerable plugin installations, discovers target emails, and attempts to trigger the authentication bypass. It reports success/failure but does not deliver a payload or perform post-exploitation actions. The README describes it as a 'scanner' and 'tarayıcı' (Turkish for scanner).

CVE-2026-5229.py:595README.md:1-3

Requirements

  • Target WordPress site with Form Notify plugin (<=1.1.10) and LINE Login activeCVE-2026-5229.py:170-226
  • Target user email address (auto-discovered or manually provided)CVE-2026-5229.py:60-164

Observed behavior

  • Detects Form Notify plugin and LINE Login activation via REST endpoints, plugin files, and page sourceCVE-2026-5229.py:170-226
  • Discovers target user emails via WordPress REST API and page scrapingCVE-2026-5229.py:60-164
  • Attempts Path A (cookie injection) by setting 'form_notify_line_email' cookie and simulating LINE OAuth callbackCVE-2026-5229.py:232-340
  • Attempts Path B (email match) by initiating LINE OAuth flow and providing manual instructionsCVE-2026-5229.py:346-396
  • Verifies successful authentication by checking WordPress auth cookies and calling /wp-json/wp/v2/users/meCVE-2026-5229.py:402-422
  • Outputs results with status indicators (AUTH_OK, WP-ADMIN, MANUAL, etc.) and writes successful bypasses to a fileCVE-2026-5229.py:525-587
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Python script sends HTTP requests to target WordPress sites to detect the Form Notify plugin, discover user emails, and attempt authentication bypass via cookie injection or OAuth flow simulation.This is the expected behavior of a PoC for the described CVE-2026-5229 vulnerability.CVE-2026-5229.py:60-164CVE-2026-5229.py:232-340CVE-2026-5229.py:346-396
Network Communication
Script connects to user-supplied target URLs and optionally a user-supplied proxy. No hardcoded external callback or exfiltration endpoint is present.All network targets are controlled by the user running the script; no data is sent to an attacker-controlled server.CVE-2026-5229.py:428-445CVE-2026-5229.py:436-437
File Output
Script writes results to a local file specified by the user (default auth_bypass.txt). No evidence of writing to system directories, modifying persistence mechanisms, or dropping unrelated payloads.Output is limited to saving scan results for the operator's review.CVE-2026-5229.py:545-550CVE-2026-5229.py:647-655
Review boundaries

What the analysis did not establish

  • complete_artifact_coverage is false; only two text files are included, and the repository may contain additional files not analyzed
  • The scanner uses a mock authorization code ('mock_auth_code_path_a') for Path A, so full automated exploitation is not demonstrated without a real LINE OAuth code
  • Review is limited to the two text files (CVE-2026-5229.py and README.md) supplied in the evidence packet. No binary files were identified or analyzed. The script's behavior when executed with real LINE OAuth tokens is not verified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1