Nxploited/CVE-2026-12416-CVE-2026-12417

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that performs unauthenticated password reset on WordPress sites via vulnerable AJAX handlers (CVE-2026-12416, CVE-2026-12417), then attempts to log in and verify administrator access, saving confirmed credentials.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python mass-exploitation scanner and a README that describe and implement unauthenticated password-reset attacks against two known WordPress plugin vulnerabilities (CVE-2026-12416 and CVE-2026-12417). The code performs exactly the advertised exploit behavior: sending crafted AJAX requests to reset passwords, attempting login, verifying admin access, and saving results. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm beyond the stated exploit is present in the reviewed text.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareWordPressSignUp & SignIn pluginInvoice Generator plugin
Attack typesAccount TakeoverAuthentication BypassPrivilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively changes user passwords on remote targets (line 186-212) and then uses the new credentials to authenticate and verify admin access (line 321-389). This goes beyond detection or scanning; it exercises the vulnerability to achieve account takeover, which is the definition of an exploit.

CVE-2026-12416--CVE-2026-12417.py:186-212CVE-2026-12416--CVE-2026-12417.py:321-389

Requirements

  • Target WordPress site must have vulnerable SignUp & SignIn or Invoice Generator plugin (<=1.0.0) installed and accessible.README.md:14-38
  • Attacker must supply a list of target URLs in a file.CVE-2026-12416--CVE-2026-12417.py:456-457

Observed behavior

  • Sends POST request to /wp-admin/admin-ajax.php with action=pravel_change_password or pravel_invoice_change_password, an empty reset_activation_code, and attacker-chosen new_password_custom to reset a user's password.CVE-2026-12416--CVE-2026-12417.py:186-212
  • After a successful password reset, enumerates usernames via REST API and author redirects, then attempts to log in to /wp-login.php with the new password.CVE-2026-12416--CVE-2026-12417.py:280-305CVE-2026-12416--CVE-2026-12417.py:321-365
  • Verifies administrator privileges by accessing /wp-admin/users.php and checking for admin-specific HTML markers.CVE-2026-12416--CVE-2026-12417.py:368-389
  • Saves confirmed admin credentials (URL, username, password) to scan_results/pravel_admin_success.txt.CVE-2026-12416--CVE-2026-12417.py:152-163
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script sends POST requests to /wp-admin/admin-ajax.php with action=pravel_change_password or action=pravel_invoice_change_password, an empty reset_activation_code, and a hardcoded new password to reset arbitrary user accounts.This is the normal exploit behavior for the referenced CVEs and is fully documented in the README and code comments.CVE-2026-12416--CVE-2026-12417.py:186-212README.md:44-81
Hardcoded Credential
NEW_PASSWORD = "Nxploited@123KSa"The password set on compromised accounts is hardcoded and used for subsequent login verification. This is part of the exploit workflow, not a backdoor.CVE-2026-12416--CVE-2026-12417.py:34
Result Exfiltration
Successful admin credentials are saved to scan_results/pravel_admin_success.txt.This is the intended output of the scanner and is disclosed in the README. It does not represent covert exfiltration.CVE-2026-12416--CVE-2026-12417.py:152-163README.md:95-99
Review boundaries

What the analysis did not establish

  • One file (likely .gitignore or similar) was omitted from text content; its metadata shows 1505 bytes and is not expected to alter classification.
  • Evidence coverage is complete for the two provided text files; no other files were identified as relevant.
  • One file (1505 bytes) was present in the repository but classified as unclassified and was not provided as text; its content is unknown.
  • Binary analysis was not performed; the review is limited to the supplied readable text files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2