xxconi/CVE-2026-3296

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based scanner for CVE-2026-3296 that detects the vulnerability by injecting a benign serialized PHP object payload into Everest Forms and checking for successful storage, without exploiting the deserialization flaw for code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python scanner script and a README for CVE-2026-3296, a PHP Object Injection vulnerability in the Everest Forms WordPress plugin. The script automates vulnerability scanning and exploitation of the described CVE. It contains no concealed backdoor, deceptive payload, or operator-directed harm against the person running the PoC. All behavior is consistent with the stated purpose of testing the target vulnerability.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareEverest Forms WordPress plugin
Attack typesdeserialization of untrusted data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a scanner. In --mode scan (the default), it injects a benign probe payload (stdClass with no magic methods) to test if the injection path is viable, and reports VULNERABLE without attempting to trigger deserialization or achieve code execution. The --mode inject and --mode full modes require admin credentials to trigger deserialization, but the artifact's default and primary stated operation is vulnerability detection, not exploitation.

CVE-2026-3296.py:19-23CVE-2026-3296.py:78-83CVE-2026-3296.py:646-653CVE-2026-3296.py:835-838

Requirements

  • Target must have Everest Forms plugin <= 3.4.3 installed and a public form accessible.CVE-2026-3296.py:525-557

Observed behavior

  • Detects the plugin by checking readme.txt, page content, and REST API endpoints.CVE-2026-3296.py:525-557
  • Parses public form pages to extract form IDs, nonces, and field names.CVE-2026-3296.py:129-241
  • Injects a benign stdClass serialized payload into form fields via POST request.CVE-2026-3296.py:247-357
  • Reports VULNERABLE status upon successful injection, indicating the payload was stored and awaits admin trigger.CVE-2026-3296.py:646-653
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Scanner
CVE-2026-3296.pyThe script automates injection of serialized PHP object payloads into vulnerable WordPress forms and optionally triggers deserialization via admin login. This is normal exploit behavior for the stated CVE.CVE-2026-3296.py:1-921
Payload Generation
build_payload functionGenerates benign probe payloads (stdClass) and placeholders for RCE chains. The RCE placeholders are comments instructing the user to generate real payloads with PHPGGC; they are not executable code.CVE-2026-3296.py:64-123
Admin Credential Usage
admin_login functionThe script accepts admin credentials as command-line arguments and uses them to log into the target WordPress site. This is required for the trigger phase of the exploit and is not a backdoor against the operator.CVE-2026-3296.py:423-464
Review boundaries

What the analysis did not establish

  • The evidence includes only two text files (Python script and README); no binary or dependency files were inspected.
  • The artifact's complete_artifact_coverage is false, indicating not all repository files were provided.
  • The analysis is based solely on static code review; the code was not executed.
  • Only the two text files (CVE-2026-3296.py and README.md) were reviewed. No binary files were present in the evidence packet.
  • The review does not assess the safety or legality of using this exploit against third-party systems.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1