GitHub Exploit Metadata - Exploit Intel

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

The artifact is a README writeup for CVE-2025-67586 that includes a step-by-step procedure and a curl command to exploit a broken access control vulnerability in the WordPress Highlight and Share plugin, allowing unauthenticated email sending.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a single README.md file containing a textual writeup and a curl command demonstrating an unauthenticated AJAX exploit for CVE-2025-67586. No executable code, obfuscated payloads, or instructions to run anything other than the documented curl command are present. The described behavior targets the stated WordPress plugin vulnerability and does not exhibit concealed operator-directed harm, persistence, credential theft, or unrelated payload delivery.

ClassificationExploit

Model confidence95%

AuthenticationNot required

LanguagesMarkdownShell

Target softwareWordPress Highlight and Share plugin

Attack typesBroken Access ControlEmail Spam

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact provides a curl command that sends a crafted POST request to the vulnerable endpoint to trigger unauthorized email sending, which constitutes exploit code. The writeup describes the vulnerability and includes executable instructions to exercise it.

README.md:5README.md:42-51

Requirements

A target website with the vulnerable Highlight and Share plugin (<= 5.2.0) installed.README.md:7-9
A valid nonce obtained from a public post's 'Share via Email' functionality.README.md:28-36

Observed behavior

Sends an unauthenticated POST request to wp-admin/admin-ajax.php with the action 'has_email_form_submission' and attacker-controlled parameters, including a captured nonce, to trigger email sharing.README.md:42-51
The expected response indicates successful email sending with attacker-supplied recipient address.README.md:54-66

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Curl Command: curl -s -i -X POST 'http://localhost/wp-admin/admin-ajax.php' -d 'action=has_email_form_submission' -d 'formData[postId]=<POSTID>' -d 'formData[permalink]=http://localhost/?p=<POSTID>' -d 'formData[nonce]=<NONCE>' -d 'formData[toEmail]=attacker@example.com' -d 'formData[subject]=PoC' -d 'formData[shareText]=POC test' -d 'formData[emailShareType]=selection' --compressedThe curl command is the only actionable content in the PoC. It sends a POST request to the target WordPress admin-ajax.php endpoint with parameters that match the described vulnerability (unauthenticated email sharing). The command does not download or execute external resources, establish reverse shells, or exfiltrate data to an attacker-controlled server beyond the documented email abuse.README.md:42-51

Review boundaries

What the analysis did not establish

Only one of two text files (README.md) is included; the second file is omitted, so its content is unknown.
The evidence packet reports complete_artifact_coverage as false, indicating the full artifact is not provided.
One file (1,064 bytes) was classified as unclassified and reported as metadata-only; its content was not inspected. The inventory analysis indicates no executable source or binary files were identified in the repository, but the unclassified file's content remains unknown.
Only the README.md file content was provided; the second text file in the repository was not included in the evidence packet.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

r0xtsec/CVE