0xBlackash/CVE-2026-64638

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that checks a target WordPress site for vulnerability to CVE-2026-64638 by detecting the installed version and comparing it against known patched versions. It does not contain any XSS payload, RCE chain, or exploitation logic.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README describing CVE-2026-64638 and a Python script that performs safe version detection. The script only fetches public pages from a user-supplied URL to extract the WordPress version and compares it against a hardcoded list of fixed versions. No XSS payloads, RCE chains, social-engineering components, or any other concealed harmful behavior are present. The code's behavior is fully disclosed and consistent with its stated purpose.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareWordPress
Attack typesVersion Detection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script explicitly states it is a 'SAFE checker only' with 'NO XSS payloads, NO RCE chain, NO social-engineering components' and performs only version detection and comparison. It does not attempt to exploit or trigger the vulnerability.

wordpress_cve_2026_64638_safe_check.py:2-5

Requirements

  • Target WordPress URL must be provided as a command-line argument.wordpress_cve_2026_64638_safe_check.py:134-140
  • The 'packaging' Python library must be installed.wordpress_cve_2026_64638_safe_check.py:13

Observed behavior

  • Fetches HTML content from common WordPress paths (/, /wp-login.php, /readme.html, /feed/, /?rest_route=/) to extract the version string from meta tags, readme, or RSS feed.wordpress_cve_2026_64638_safe_check.py:65-106
  • Compares the detected version against a hardcoded dictionary of fixed versions to determine if the target is vulnerable.wordpress_cve_2026_64638_safe_check.py:24-63
  • Prints a vulnerability status (VULNERABLE or SAFE) and remediation advice to stdout.wordpress_cve_2026_64638_safe_check.py:108-132
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
user-supplied argument (sys.argv[1])The script takes a single URL as a command-line argument and fetches public pages from that host to determine the WordPress version. This is the disclosed and expected behavior for a version checker.wordpress_cve_2026_64638_safe_check.py:134-140
Review boundaries

What the analysis did not establish

  • The evidence includes only the README.md and the scanner script; no exploit code or detailed technical writeup is present.
  • The scanner relies solely on version string extraction and comparison, which may produce false positives or negatives if the version is obscured or if a backport patch is applied without a version bump.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1