xxconi/CVE-2026-2942

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based scanner that checks for CVE-2026-2942, an unauthenticated arbitrary file upload vulnerability in the ProSolution WP Client WordPress plugin. It attempts to extract a nonce from public pages, upload a PHP webshell using MIME type spoofing, and optionally verify remote code execution. The tool is designed for bulk scanning and reporting, not for delivering a single targeted exploit payload.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python scanner (CVE-2026-2942.py) and a README.md that together implement and document a proof-of-concept exploit for CVE-2026-2942, an unauthenticated arbitrary file upload vulnerability in the ProSolution WP Client WordPress plugin. The scanner automates nonce extraction, uploads a PHP webshell with a spoofed MIME type, and optionally verifies remote code execution. All behavior is consistent with the stated exploit objective. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm was observed in the reviewed text.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareProSolution WP ClientWordPress
Attack typesarbitrary file uploadremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a scanner. It is designed to check multiple targets for the presence of the vulnerability, report status, and optionally verify RCE. It includes bulk scanning, progress reporting, and output file writing, which are characteristic of a vulnerability scanner rather than a single-use exploit. The README explicitly calls it a 'scanner' and 'tarayıcı' (Turkish for scanner).

CVE-2026-2942.py:3README.md:1README.md:144CVE-2026-2942.py:374CVE-2026-2942.py:428-445

Requirements

  • Target must have the ProSolution WP Client plugin (<= 1.9.9) active with a public page containing the [prosolfrontend] shortcode to expose the nonce.README.md:7README.md:52-53

Observed behavior

  • Scans a single URL or a list of URLs. For each target, it fetches the homepage and other common paths to extract a nonce from the prosolObj JavaScript object.CVE-2026-2942.py:79-154CVE-2026-2942.py:272-315
  • Sends a POST request to /wp-admin/admin-ajax.php with action=proSol_fileUploadProcess, the extracted nonce, and a PHP file disguised with image/jpeg MIME type.CVE-2026-2942.py:182-246
  • Parses the JSON response to determine if the PHP file was uploaded successfully (extension remains .php).CVE-2026-2942.py:214-239
  • Optionally verifies RCE by requesting the uploaded shell URL with a command parameter and checking for expected output (e.g., 'uid=').CVE-2026-2942.py:252-266CVE-2026-2942.py:307-312
  • Reports results with color-coded status messages (UPLOADED, BLOCKED, NO_NONCE, etc.) and writes successful shell URLs to an output file.CVE-2026-2942.py:321-366CVE-2026-2942.py:422-425
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Automated nonce extraction from public pages, MIME-spoofed PHP webshell upload, and optional RCE verificationThe scanner performs the exact steps described in the CVE and README to exploit the file upload vulnerability. This is normal exploit behavior, not a backdoor.CVE-2026-2942.py:182-246CVE-2026-2942.py:252-266CVE-2026-2942.py:272-315
Webshell Payload
Multiple PHP webshell variants (system, passthru, exec, assert, b64, full)The payloads are standard PHP webshells used to demonstrate RCE on the target. They are part of the advertised exploit and do not indicate a backdoor against the operator.CVE-2026-2942.py:160-176
Review boundaries

What the analysis did not establish

  • Evidence is limited to the two text files provided; no binary or additional source files were inspected.
  • The artifact's complete_artifact_coverage is false, indicating not all repository files were included, though the two provided files appear complete.
  • Classification is based solely on static analysis of the provided source code; the code was not executed, and its actual behavior is not verified.
  • Only the two text files (CVE-2026-2942.py and README.md) were provided and reviewed. No binary files were present. The analysis does not cover any external dependencies (e.g., the 'requests' library) or the runtime behavior of the Python interpreter.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1