Nxploited/CVE-2026-13714

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-13714 in WPL Real Estate plugin by uploading a PHP web shell via hardcoded I/O API keys, then locating and verifying the uploaded file for remote code execution.

Backdoor review

No backdoor observed in reviewed code

The PoC is a Python script that exploits CVE-2026-13714 by uploading a PHP file to a vulnerable WordPress plugin using hardcoded API keys. The script's behavior is fully disclosed in the README and code. The uploaded PHP payload (UPLOADER_RAW) is a simple file upload form that echoes a signature, with no hidden or unrelated malicious actions. All network communication is directed at the operator-supplied target list. No concealed data exfiltration, persistence, or unrelated payload execution was found.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareRealtyna Organic IDX plugin + WPL Real EstateWordPress
Attack typesarbitrary file uploadremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script whose main 'Upload' mode (mode 2) actively exploits the vulnerability by uploading a functional PHP web shell to a target server and verifying its accessibility, which constitutes exploitation, not just detection.

CVE-2026-13714.py:15-18CVE-2026-13714.py:430-433CVE-2026-13714.py:461-473README.md:74

Requirements

  • Target running WPL Real Estate plugin version ≤ 5.2.0 with default hardcoded I/O API keys.CVE-2026-13714.py:10-12README.md:13-15
  • Target must have the I/O API enabled (enabled by default).README.md:13

Observed behavior

  • Authenticates to the WPL I/O API using hardcoded public and private keys.CVE-2026-13714.py:235-239
  • Uploads a PHP file (base64-decoded web shell) via a multipart POST request to the set_property endpoint.CVE-2026-13714.py:141-162CVE-2026-13714.py:227-274
  • Scans predictable upload directories to locate the uploaded PHP file and verifies its presence by checking for the 'Nx-zD' signature.CVE-2026-13714.py:280-302CVE-2026-13714.py:461-463
  • Logs the URL of the successfully uploaded and verified shell to a file.CVE-2026-13714.py:470
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Credentials
IO_PUBLIC = 'U7hdbv673YhdjplzzX7wU7hdbv673YhdjplzzX7w', IO_PRIVATE = 'Eft76bdh0o2uyhJkbG3T'These are the hardcoded API keys used by the vulnerable plugin, as described in the CVE and README. They are used to authenticate to the target, not to exfiltrate data to a third party.CVE-2026-13714.py:11-12
Uploaded Payload
PD9waHAgZWNobyJOeC16RCAiO2lmKGlzc2V0KCRfRklMRVNbImYiXSkpeyRkPWRpcm5hbWUoX19GSUxFX18pLiIvIjskbj1iYXNlbmFtZSgkX0ZJTEVTWyJmIl1bIm5hbWUiXSk7aWYobW92ZV91cGxvYWRlZF9maWxlKCRfRklMRVNbImYiXVsidG1wX25hbWUiXSwkZC4kbikpZWNobyJPSzoiLiRkLiRuO2Vsc2UgZWNobyJFUlIiO31lbHNlIGVjaG8nPGZvcm0gbWV0aG9kPVBPU1QgZW5jdHlwZT0ibXVsdGlwYXJ0L2Zvcm0tZGF0YSI+PGlucHV0IG5hbWU9ZiB0eXBlPWZpbGU+PGlucHV0IHR5cGU9c3VibWl0IHZhbHVlPU54PjwvZm9ybT4nOz8+Base64-encoded PHP payload uploaded to the target. Decoded, it is a simple file upload form that echoes the signature 'Nx-zD'. It contains no backdoor, reverse shell, or data exfiltration logic.CVE-2026-13714.py:15
Network Target
operator-supplied target listAll HTTP requests are made to URLs derived from the user-provided target list file. There are no hardcoded external callback addresses.CVE-2026-13714.py:602-608CVE-2026-13714.py:623-632
Review boundaries

What the analysis did not establish

  • Evidence does not include the third file (unclassified_bytes: 1505) from the repository, which is omitted from the packet.
  • The analysis is based solely on the provided source code and README; the code was not executed, and its operational success is not verified.
  • One file (metadata only) was omitted from the evidence, but it is not a text file and its absence does not affect the analysis of the provided Python script and README.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1