xxconi/CVE-2026-6271

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that automates unauthenticated arbitrary file upload and remote code execution against the Career Section WordPress plugin (CVE-2026-6271). It discovers job listing pages, extracts a public nonce, uploads a PHP webshell disguised as a PDF, brute-forces the timestamp-based filename, and executes a system command to confirm RCE.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script (CVE-2026-6271.py) and a README.md for CVE-2026-6271, an unauthenticated arbitrary file upload vulnerability in the Career Section WordPress plugin. The script automates exploitation of the described vulnerability: it discovers job listing URLs, extracts a public nonce, uploads a PHP webshell disguised as a PDF, and brute-forces the timestamp-based filename to achieve remote code execution. All behavior is consistent with a standard proof-of-concept exploit targeting the stated CVE. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm was observed. The code is readable Python with no obfuscation or opaque executable payloads.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespythonbashmarkdown
Target softwareCareer Section WordPress plugin
Attack typesarbitrary file uploadremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively uploads a PHP webshell and executes commands on the target, which constitutes exploitation, not just detection or scanning. The README describes the same exploit steps manually and calls the script a 'scanner', but the code's primary operation is exploitation.

CVE-2026-6271.py:194-228CVE-2026-6271.py:276-310README.md:177-178

Requirements

  • Target must run Career Section plugin version <= 1.7 with at least one published job listing.README.md:93-94
  • The upload directory must allow PHP execution (no .htaccess restriction).README.md:72

Observed behavior

  • Discovers job listing URLs via sitemap, REST API, and common slug guessing.CVE-2026-6271.py:84-128
  • Extracts the csaf_form_nonce from the public HTML of a job listing page.CVE-2026-6271.py:146-152
  • Uploads a PHP webshell file with a spoofed application/pdf MIME type via the job application form.CVE-2026-6271.py:194-228
  • Brute-forces the upload timestamp to locate the uploaded shell and executes a command (default 'id') to confirm RCE.CVE-2026-6271.py:276-310
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Automated exploitation of CVE-2026-6271: nonce extraction, PHP webshell upload with MIME spoofing, timestamp brute-force for shell URL, and RCE verification.The script performs the exact steps described in the CVE and README to demonstrate the vulnerability. No actions outside the scope of the exploit were identified.CVE-2026-6271.py:194-268CVE-2026-6271.py:276-310CVE-2026-6271.py:316-375
Webshell Payload
Multiple PHP one-liners (system, passthru, exec, assert, base64 eval, and a full fallback shell) are generated and uploaded to the target.These are standard webshells used to demonstrate RCE on the vulnerable plugin. They are not hidden or unrelated to the exploit.CVE-2026-6271.py:52-68
Network Communication
The script sends HTTP requests to the target WordPress site to discover job URLs, extract nonces, upload the shell, and trigger RCE.All network activity is directed at the target specified by the user and is necessary for the exploit. No external callbacks or data exfiltration to third parties were found.CVE-2026-6271.py:84-128CVE-2026-6271.py:169-188CVE-2026-6271.py:194-268CVE-2026-6271.py:276-310
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied text files; no runtime behavior or external network interactions were observed.
  • The artifact is labeled as a scanner in its own documentation, but the code performs exploitation actions.
  • Only the two text files (CVE-2026-6271.py and README.md) were reviewed; no other files from the repository were provided.
  • The review is static and does not include dynamic analysis or execution of the script.
  • The artifact's network behavior was not observed at runtime; the analysis is based solely on the source code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1