CVE-2026-16258 Exploit Metadata

PoC files

12 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

The artifact is a Python 3 exploit for CVE-2026-16258, an unauthenticated PHP Object Injection vulnerability in the Ajax Search Lite WordPress plugin. The script sends a serialized PHP object to a vulnerable REST endpoint, which triggers deserialization and executes a canary gadget's __destruct method to write a marker file, confirming code execution.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates a legitimate PHP Object Injection exploit against a known vulnerability (CVE-2026-16258). The Python script sends a serialized payload to a vulnerable REST endpoint and verifies the side effect by reading a marker file from a Docker container. No concealed executable behavior, credential theft, persistence, or unrelated payload delivery is present. The script's actions are fully explained in the documentation and align with the stated vulnerability.

ClassificationExploit

Model confidence95%

AuthenticationNot required

Languagespython

Target softwareAjax Search Lite

Attack typesdeserialization of untrusted dataremote code execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script (poc/poc.py) that actively exploits the vulnerability by sending a malicious payload to trigger deserialization and then verifies the side effect (file creation) to confirm code execution. This meets the definition of an exploit.

poc/poc.py:1-141

Requirements

The target WordPress site must have the Ajax Search Lite plugin (version < 4.14.5) installed and the search statistics feature enabled.README.md:27-29
A suitable POP gadget chain must be present on the target (provided by the lab's canary gadget for demonstration).poc/poc.py:25-27

Observed behavior

Sends an unauthenticated POST request to /wp-json/ajax-search-lite/statistics/searches/add with a JSON body containing a serialized PHP object in the 'phrase' field.poc/poc.py:106
The serialized object is crafted to instantiate a canary class whose __destruct method writes a unique marker file to /tmp/ on the target server.poc/poc.py:56-63
Verifies successful exploitation by reading the marker file from the Docker container and comparing its contents to the expected token.poc/poc.py:113-126

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request: POST /wp-json/ajax-search-lite/statistics/searches/addThe exploit sends a crafted serialized PHP object to the vulnerable endpoint to trigger deserialization.poc/poc.py:50poc/poc.py:106
Serialized Payload: O:27:"CVE_2026_16258_Canary_Gadget":2:{s:6:"marker";s:...}The payload is a hand-crafted serialized object of a lab-only canary class, used to prove object injection by writing a marker file.poc/poc.py:56-63
Docker Command: docker exec <container> cat <marker_path>The script reads the marker file from the target Docker container to verify the exploit's side effect.poc/poc.py:76-85

Review boundaries

What the analysis did not establish

The analysis is based solely on the provided text files; the binary zip files (assets/asl-4.14.4.zip, assets/asl-4.14.5.zip) were not inspected.
The exploit relies on a lab-specific canary gadget and Docker environment for verification; its effectiveness against arbitrary targets depends on the presence of a suitable POP chain.
Two binary zip files (assets/asl-4.14.4.zip, assets/asl-4.14.5.zip) were flagged as BINARY and not analyzed. The PoC script does not execute or extract these files; they are used by the lab setup script (seed.sh) which was not provided for review.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

CVE-2026-16258/docker-compose.control.yml

Created 2026-05-19Vuln labCVE-2026-16258Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Environment assessment

A Docker Compose environment for CVE-2026-16258, an unauthenticated PHP object injection vulnerability in the Ajax Search Lite WordPress plugin. It includes a MariaDB database and a WordPress web server with the vulnerable plugin and a lab-only canary gadget to demonstrate the impact.

CVE-2026-16258/docker-compose.control.yml:1-42CVE-2026-16258/README.md:1-82

Lab assessment

Vulnerability lab

The environment is explicitly designed to reproduce and verify CVE-2026-16258. It includes a vulnerable WordPress plugin, a canary gadget to demonstrate object injection, a PoC script, and detailed instructions for exercising the vulnerability.

CVE-2026-16258/README.md:1-82CVE-2026-16258/poc/poc.py:1-141

Lab shapeCompose · images

Services2

Compose manifests1

Dockerfiles0

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

db

database

MariaDB 10.11 database service for WordPress, configured with a healthcheck.

CVE-2026-16258/docker-compose.control.yml:4-16

web

web serverWordPress applicationvulnerable target

WordPress 6.x on PHP 8.2 with Apache, serving the Ajax Search Lite plugin and a lab-only canary gadget. The plugin's search-statistics REST route is unauthenticated and vulnerable to PHP object injection.

CVE-2026-16258/docker-compose.control.yml:18-36CVE-2026-16258/README.md:15-30

canary-gadget

POP gadgetimpact demonstrator

A lab-only WordPress plugin that provides a class with a __destruct method writing an attacker-controlled file, used to prove object injection without a real-world POP chain.

CVE-2026-16258/assets/canary-gadget/canary-gadget.php:1-34

poc.py

exploit scriptverification tool

Python script that sends a serialized payload to the vulnerable REST route and verifies object injection by reading a marker file from the target container.

CVE-2026-16258/poc/poc.py:1-141

seed.sh

environment setupconfiguration

Bash script that installs WordPress, the plugin, and the canary gadget, enables search statistics, and creates test users.

CVE-2026-16258/seed.sh:1-124

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-16258

Supported by supplied evidence

The evidence describes an unauthenticated PHP object injection in Ajax Search Lite < 4.14.5 via the search-statistics REST route, matching the CVE description. The PoC demonstrates the vulnerability and the fix is verified in the control environment.

CVE-2026-16258/README.md:15-30CVE-2026-16258/poc_verification_report.md:1-27

Exercise context

Requirements and sequence described by the evidence

Prerequisites

The search-statistics feature must be enabled by an administrator (disabled by default).CVE-2026-16258/README.md:25-27
A suitable POP chain must be present via another installed plugin/theme for RCE; the lab uses a canary gadget to demonstrate the injection primitive.CVE-2026-16258/README.md:28-30
Docker and Docker Compose are required to run the lab.CVE-2026-16258/README.md:47-48

Evidence-described exercise path

Start the vulnerable environment with 'docker compose up -d' and seed it with 'bash seed.sh lab'.CVE-2026-16258/README.md:50-52
Run the PoC script against the vulnerable target: 'python3 -u poc/poc.py 127.0.0.1 8080 --container cve-2026-16258-lab-web-1'.CVE-2026-16258/README.md:55-56
Start the fixed control environment with 'docker compose -p cve-2026-16258-control -f docker-compose.control.yml up -d' and seed it with 'bash seed.sh control'.CVE-2026-16258/README.md:58-60
Run the PoC against the control target to verify the fix: 'python3 -u poc/poc.py 127.0.0.1 8081 --container cve-2026-16258-control-web-1'.CVE-2026-16258/README.md:62-63

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab target. The PoC writes a marker file inside the target container to demonstrate the vulnerability, which is expected for a vulnerability lab. No host escape, external connections, persistence, credential theft, or destructive actions are observed.

CVE-2026-16258/poc/poc.py:1-141CVE-2026-16258/seed.sh:1-124

Review boundaries

What the analysis did not establish

The docker-compose.yml for the vulnerable environment is not included in the evidence files, only the control compose file is present.
The plugin zip files (asl-4.14.4.zip and asl-4.14.5.zip) are uninspected binaries.
The intel_brief.md and vulnerability_analysis.md files are referenced but not included in the evidence.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

GitHub

CVE-2026-16258/docker-compose.yml

Created 2026-05-19Vuln labCVE-2026-16258Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Environment assessment

A Docker Compose environment for reproducing CVE-2026-16258, an unauthenticated PHP Object Injection vulnerability in the Ajax Search Lite WordPress plugin. It consists of a MariaDB database and a WordPress web server with the vulnerable plugin and a lab-only canary gadget mounted.

CVE-2026-16258/docker-compose.yml:1-40CVE-2026-16258/README.md:1-82

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a lab for reproducing CVE-2026-16258, with instructions for running a vulnerable and a patched control environment, and a PoC script to demonstrate the vulnerability.

CVE-2026-16258/README.md:1-82

Lab shapeCompose · images

Services2

Compose manifests1

Dockerfiles0

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

db

database

MariaDB 10.11 database service for WordPress, configured with a healthcheck.

CVE-2026-16258/docker-compose.yml:2-13

web

web servervulnerable target

WordPress 6.x on PHP 8.2 with Apache, serving the vulnerable Ajax Search Lite plugin and a lab-only canary gadget. Exposes port 80 on a host port defined by WEB_PORT.

CVE-2026-16258/docker-compose.yml:15-33

canary-gadget

POP gadgetvulnerability demonstration aid

A lab-only WordPress plugin that provides a class with a __destruct method which writes a file to a path and with contents controlled by the attacker via a serialized object. It is used to prove the unserialize instantiation and magic method execution.

CVE-2026-16258/assets/canary-gadget/canary-gadget.php:1-34

poc.py

exploit scriptverification tool

A Python 3 script that sends a serialized PHP object to the vulnerable REST endpoint and verifies the vulnerability by checking for a marker file written inside the target container via docker exec.

CVE-2026-16258/poc/poc.py:1-141

seed.sh

environment setuplab initialization

A bash script that installs WordPress, the vulnerable or patched plugin, the canary gadget, enables search statistics, creates users, and verifies the setup.

CVE-2026-16258/seed.sh:1-124

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-16258

Supported by supplied evidence

The provided evidence describes an unauthenticated PHP Object Injection in Ajax Search Lite < 4.14.5, matching the CVE description. The PoC and verification report confirm successful exploitation on the vulnerable version and inert behavior on the patched version.

CVE-2026-16258/README.md:1-82CVE-2026-16258/poc_verification_report.md:1-27CVE-2026-16258/poc/poc.py:1-141

Exercise context

Requirements and sequence described by the evidence

Prerequisites

The search statistics feature must be enabled by an administrator (disabled by default).CVE-2026-16258/README.md:24-26
A suitable POP gadget chain must be present via another installed plugin or theme for RCE; the lab provides a canary gadget for demonstration.CVE-2026-16258/README.md:27-28
Docker and Docker Compose are required to run the lab.CVE-2026-16258/README.md:42-43

Evidence-described exercise path

Start the vulnerable environment with `docker compose up -d`.CVE-2026-16258/README.md:46-47
Run `bash seed.sh lab` to install WordPress, the vulnerable plugin, the canary gadget, and enable search statistics.CVE-2026-16258/README.md:47
Execute the PoC: `python3 -u poc/poc.py 127.0.0.1 8080 --container cve-2026-16258-lab-web-1`.CVE-2026-16258/README.md:50-51
Optionally, start the patched control environment and run the PoC against it to verify the fix.CVE-2026-16258/README.md:49-54

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab target. The PoC writes a marker file inside the web container and reads it back via docker exec, which is the expected demonstration of the vulnerability. No host escape, external connections, persistence, or credential theft is observed.

CVE-2026-16258/poc/poc.py:80-90CVE-2026-16258/poc/poc.py:100-120

Review boundaries

What the analysis did not establish

The docker-compose.control.yml file is not included in the evidence, so the control environment cannot be fully assessed.
The plugin zip files (asl-4.14.4.zip, asl-4.14.5.zip) are uninspected binaries.
The PoC uses `docker exec` to read the marker file, which requires Docker access on the host; this is a lab convenience, not an exploit behavior.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

Linked vulnerabilities

CVE-2026-16258