xxconi/CVE-2026-6279

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2026-6279 that achieves unauthenticated remote code execution on Avada Builder <= 3.15.2 by injecting PHP functions via the 'wp_conditional_tags' case in call_user_func(). It includes nonce extraction, Cloudflare origin IP bypass, an interactive shell, and batch scanning.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a Python script and README that exploit CVE-2026-6279 (unauthenticated RCE in Avada Builder) by sending crafted AJAX requests to a target WordPress site. The code performs only the advertised exploit behavior: nonce extraction, AJAX endpoint discovery, and command execution via call_user_func injection. No concealed backdoor, unrelated payload, credential exfiltration to an external party, or persistence mechanism was observed. The script includes an interactive shell, batch scanning, file upload/download, and reverse shell features, all of which are standard post-exploitation utilities consistent with the stated vulnerability and do not constitute a backdoor.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareAvada Builder (fusion-builder)WordPress
Attack typesremote code executionauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional exploit that actively sends malicious payloads to achieve remote code execution. It does not merely detect or report the vulnerability; it exploits it by calling system(), passthru(), and other PHP functions to run arbitrary commands on the target.

CVE-2026-6279.py:718-724CVE-2026-6279.py:732-826

Requirements

  • Target must have Avada Builder <= 3.15.2 installed and active.CVE-2026-6279.py:32
  • Target must expose the fusion_load_nonce, which requires a public page containing the [fusion_post_cards] or [fusion_table_of_contents] shortcode.CVE-2026-6279.py:106-118

Observed behavior

  • Extracts the fusion_load_nonce from public pages by searching for specific JavaScript patterns.CVE-2026-6279.py:121-132
  • Sends crafted POST requests to the wp_ajax_nopriv_fusion_get_widget_markup endpoint with a base64-encoded JSON payload that calls arbitrary PHP functions like system() or file_get_contents().CVE-2026-6279.py:413-445
  • Attempts to bypass Cloudflare by resolving origin IP addresses and sending requests directly.CVE-2026-6279.py:363-397
  • Provides an interactive shell for command execution, file upload/download, and system reconnaissance.CVE-2026-6279.py:948-1006
  • Supports batch scanning of multiple targets from a file.CVE-2026-6279.py:1014-1103
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Sends crafted POST requests to /wp-admin/admin-ajax.php with action=fusion_get_widget_markup and base64-encoded render_logics payload to achieve RCE via call_user_func.This is the exact exploit chain described in CVE-2026-6279 and the README. No additional hidden actions were found.CVE-2026-6279.py:418-445CVE-2026-6279.py:468-496
Post Exploitation Features
Interactive shell, file upload/download, system recon, reverse shell generation.These are standard post-exploitation capabilities for a verified RCE PoC. They operate only against the targeted host and do not exfiltrate data to an unrelated third party.CVE-2026-6279.py:948-1006CVE-2026-6279.py:1145-1226
Contact Information
Telegram link (https://t.me/+-GYq8ydL9AYwZGI8) and author alias 'xxconi'/'xxcoin'.Contact information is present but does not constitute a backdoor. The script does not phone home or transmit data to this Telegram channel.README.md:284
Review boundaries

What the analysis did not establish

  • Evidence is limited to the provided repository snapshot; no external network or runtime behavior was observed.
  • The artifact's effectiveness depends on the target's configuration and the presence of required shortcodes, which cannot be verified from the evidence alone.
  • Only the two text files (CVE-2026-6279.py and README.md) were provided and reviewed. No binary files were present.
  • The script uses eval-like PHP constructs (assert) and system command execution, which are inherent to the RCE exploit and not a separate backdoor.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1