xxconi/CVE-2026-5364
PoC files
3 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
Python exploit for CVE-2026-5364 that uploads a PHP webshell to vulnerable WordPress sites via a sanitize_file_name() bypass, then executes OS commands on the target.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python exploit script (CVE-2026-5364.py) and a README.md for CVE-2026-5364, an arbitrary file upload vulnerability in a WordPress plugin. The script performs standard exploit behavior: detecting the plugin, extracting a nonce, uploading a PHP webshell via a sanitize_file_name bypass, and verifying remote code execution. No backdoor, concealed operator-directed harm, or unrelated payload was observed. The script's functionality is fully disclosed in the README and inline comments.
Classification basis and observed behavior
Classification basis
The artifact is a fully functional exploit that performs all steps required to achieve remote code execution: plugin detection, nonce extraction, malicious file upload via a sanitize_file_name() bypass, shell verification, and interactive command execution. It is not a scanner because it actively uploads and executes a webshell, not merely detecting the vulnerability.
CVE-2026-5364.py:388-467CVE-2026-5364.py:511-573CVE-2026-5364.py:851-922Requirements
- Target must run WordPress with the vulnerable plugin (<=1.1.3) and have a page containing a CF7 form to extract the nonce.
CVE-2026-5364.py:284-324README.md:56
Observed behavior
- Detects the vulnerable plugin by checking readme.txt, JS files, and HTML signals.
CVE-2026-5364.py:227-278 - Extracts a nonce from a page containing a CF7 form to authenticate the AJAX upload request.
CVE-2026-5364.py:284-324 - Uploads a PHP webshell by appending a bypass character (e.g., '$') to the filename and extension, exploiting the sanitize_file_name() bypass.
CVE-2026-5364.py:388-467 - Verifies the uploaded shell by sending an OS command and checking the response against known RCE patterns.
CVE-2026-5364.py:511-573 - Provides an interactive shell for continuous command execution on the compromised target.
CVE-2026-5364.py:851-922 - Supports bulk scanning of multiple targets with multi-threading.
CVE-2026-5364.py:734-799
Behaviors behind the backdoor verdict
Observables
- Webshell Payloads
- <?php system($_GET["cmd"]); ?> and similar PHP one-linersThese are the payloads uploaded to the target during the exploit; they are standard webshells consistent with the stated CVE and are not a backdoor against the operator.
CVE-2026-5364.py:330-336 - Exploit Technique
- sanitize_file_name bypass using trailing $ characterThe script uploads a file named shell.php$ which WordPress sanitizes to shell.php, achieving arbitrary file upload. This is the documented vulnerability mechanism.
CVE-2026-5364.py:388-403 - Interactive Shell
- interactive_shell function provides a command loop for the uploaded webshellThis is a standard post-exploitation feature for convenience, not a backdoor. It uses the same webshell URL obtained from the exploit.
CVE-2026-5364.py:851-922
What the analysis did not establish
- Evidence includes only two text files (Python exploit and README); one non-text file (likely an image) was not analyzed.
- The artifact was not executed; classification is based solely on static analysis of the provided source code.
- One non-text media file (42153 bytes) was present in the repository but not analyzed; its metadata-only inventory entry does not indicate executable behavior.
- The review is limited to the supplied text evidence; no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.