CVE-2023-26326

CRITICAL
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-26326 has a selected CVSS score of 9.8 (critical); EIP currently links 2 repository PoCs and 2 lab environments.

Description

The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2
Lab environments
2

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 12, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

BuddyForms WordPress Plugin

CVE ListAll versions prior to version 2.7.8affected

Proofs of concept

2

Repository PoCs

GitHubomarelshopky/exploit_cve-2023-26326_using_cve-2024-2961Repository PoCby omarelshopky1Not analyzed8 files

2.7 MiB · linked to 2 vulnerabilities

GitHub
PoC details
GitHubmesudmammad1/CVE-2023-26326_Buddyform_exploitRepository PoCby mesudmammad10Not analyzed4 files

1.9 MiB

GitHub
PoC details

Docker lab environments

2
GitHub

docker-compose.local.yml

whyuhurtz/wongpressCreated Vuln labCVE-2023-26326CVE-2024-29510CVE-2024-2961Compose · mixed

1 Compose manifest · 1 Dockerfile · 3 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for local testing of a vulnerable WordPress lab. It deploys MySQL, a custom WordPress image with vulnerable glibc and Ghostscript, and an Nginx reverse proxy. The lab is designed to exercise CVE-2024-2961 (glibc iconv buffer overflow) and CVE-2024-29510 (Ghostscript format string).

docker-compose.local.yml:1-5wordpress/Dockerfile.local:1-7

Lab assessment

Vulnerability lab

The Compose file header explicitly states it is a 'Vulnerable WordPress Lab Environment (FOR LOCAL TESTING)' targeting CVE-2024-2961 and CVE-2024-29510. The Dockerfile installs specific vulnerable versions (glibc 2.35, Ghostscript 10.02.1) and a vulnerable WordPress plugin (BuddyForms 2.7.6). An exploit script for CVE-2024-2961 is included.

docker-compose.local.yml:1-5wordpress/Dockerfile.local:1-7wordpress/Dockerfile.local:30-38wordpress/Dockerfile.local:56-58exploit/cve=2024-2961.py:1-4
Lab shapeCompose · mixed
Services3
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

mysql

database

MySQL 8.0 database service for WordPress. Configured with healthcheck, persistent volume, and environment variables for credentials.

docker-compose.local.yml:8-30

wordpress

vulnerable web applicationPHP-FPM backend

Custom WordPress image built from Ubuntu 22.04 with vulnerable glibc 2.35, Ghostscript 10.02.1, BuddyForms 2.7.6 plugin, and a custom mu-plugin for Ghostscript-based file conversion. Runs with SYS_ADMIN, SYS_PTRACE capabilities and AppArmor unconfined for local testing. Entrypoint script initializes WordPress, configures plugins, and creates pages for exploitation.

docker-compose.local.yml:32-67wordpress/Dockerfile.local:1-150wordpress/entrypoint.local.sh:1-392

nginx

reverse proxystatic file server

Nginx 1.29.8-alpine reverse proxy serving WordPress on port 80. Mounts configuration files and shares WordPress files for static assets.

docker-compose.local.yml:69-90nginx/nginx.conf:1-35nginx/conf.d/wordpress.local.conf:1-84

gs-convert-file.php

AJAX handler for Ghostscript conversionCVE-2024-29510 trigger

WordPress mu-plugin that handles AJAX file uploads (PS/EPS/PDF) and converts them to images using Ghostscript via exec(). The comment explicitly states it triggers CVE-2024-29510.

wordpress/mu-plugins/gs-convert-file.php:1-64

cve=2024-2961.py

exploit script for CVE-2024-2961

Python exploit script (CNEXT) that achieves RCE via PHP file read primitive using CVE-2024-2961. It targets the BuddyForms AJAX handler and uses filter chains to corrupt PHP's heap.

exploit/cve=2024-2961.py:1-576

setup.sh

deployment automation

Bash script to automate deployment of the lab locally or in production. Checks OS, installs Docker, generates .env and nginx config, and starts containers.

setup.sh:1-756
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-26326

Insufficient evidence

CVE-2023-26326 is mentioned in the Compose file header and README, but no vulnerable component or exploit for BuddyForms unauth deserialization is visible in the provided evidence. The BuddyForms plugin is installed, but no specific deserialization vulnerability is configured or demonstrated.

docker-compose.local.yml:4README.md:1-28

CVE-2024-29510

Supported by supplied evidence

The Dockerfile installs Ghostscript 10.02.1, a version known to be vulnerable to CVE-2024-29510. The mu-plugin gs-convert-file.php explicitly states it triggers this CVE and uses exec() to call Ghostscript with -dSAFER, which the format string vulnerability can bypass. The ImageMagick policy is modified to allow PS/EPS/PDF processing.

wordpress/Dockerfile.local:1-7wordpress/Dockerfile.local:88-108wordpress/mu-plugins/gs-convert-file.php:1-64

CVE-2024-2961

Supported by supplied evidence

The Dockerfile installs glibc 2.35-0ubuntu3, the vulnerable version for CVE-2024-2961. The exploit script cve=2024-2961.py is provided and targets the lab's BuddyForms AJAX handler. The entrypoint script configures the BuddyForms page and the exploit's Remote class matches the lab's endpoint.

wordpress/Dockerfile.local:30-38exploit/cve=2024-2961.py:1-4exploit/cve=2024-2961.py:40-50wordpress/entrypoint.local.sh:1-5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed on the host.setup.sh:90-130
  • The lab must be deployed using setup.sh or docker compose with the local Compose file.setup.sh:1-10docker-compose.local.yml:1-103
  • For CVE-2024-2961, the attacker must be able to reach the WordPress site and trigger the BuddyForms AJAX action 'upload_image_from_url'.exploit/cve=2024-2961.py:40-50
  • For CVE-2024-29510, the attacker must upload a malicious PS/EPS/PDF file via the 'Convert PostScript to Image' page.wordpress/mu-plugins/gs-convert-file.php:1-64wordpress/entrypoint.local.sh:200-300

Evidence-described exercise path

  1. Deploy the lab using setup.sh local or docker compose -f docker-compose.local.yml up.setup.sh:1-10docker-compose.local.yml:1-103
  2. For CVE-2024-2961: Run the exploit script cve=2024-2961.py against the WordPress site, providing the URL and a command to execute.exploit/cve=2024-2961.py:1-576
  3. For CVE-2024-29510: Upload a crafted PostScript file via the /convert-postscript-to-image page to trigger the Ghostscript format string vulnerability and achieve RCE.wordpress/mu-plugins/gs-convert-file.php:1-64wordpress/entrypoint.local.sh:200-300
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target containers. The WordPress container is given SYS_ADMIN, SYS_PTRACE, and AppArmor unconfined, which are explicitly noted as intentional for local testing. The exploit script targets the lab's own WordPress instance. No hidden persistence, credential theft, host escape, or external connectivity beyond the lab is observed.

docker-compose.local.yml:62-66exploit/cve=2024-2961.py:1-576wordpress/mu-plugins/gs-convert-file.php:1-64
Review boundaries

What the analysis did not establish

  • CVE-2023-26326 is mentioned but no vulnerable component or exploit is visible in the provided evidence.
  • The exploit script for CVE-2024-29510 is not included in the evidence files.
  • The production Compose file and Dockerfile are not included in the evidence, so the analysis is limited to the local lab configuration.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

docker-compose.prod.yml

whyuhurtz/wongpressCreated Vuln labCVE-2023-26326CVE-2024-29510CVE-2024-2961Compose · mixed

1 Compose manifest · 1 Dockerfile · 5 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment deploying a vulnerable WordPress site on Ubuntu 22.04 with Nginx, MySQL, Redis, and Certbot. The WordPress container is built with a vulnerable glibc 2.35, Ghostscript 10.02.1, and BuddyForms 2.7.6 plugin to serve as a target for CVE-2024-2961 and CVE-2024-29510 exploitation exercises.

docker-compose.prod.yml:1-5wordpress/Dockerfile.prod:1-6

Lab assessment

Vulnerability lab

The environment is explicitly labeled as a 'Vulnerable WordPres Lab Environment' for CVE-2024-2961 and CVE-2024-29510. It includes intentionally vulnerable software versions (glibc 2.35, Ghostscript 10.02.1, BuddyForms 2.7.6), a custom Ghostscript AJAX handler, and an exploit script for CVE-2024-2961, all indicating a vulnerability research purpose.

docker-compose.prod.yml:1-5wordpress/Dockerfile.prod:1-6exploit/cve=2024-2961.py:1-4
Lab shapeCompose · mixed
Services5
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

mysql

database

MySQL 8.0 database service for WordPress, configured with healthcheck and persistent volume.

docker-compose.prod.yml:8-30

redis

object cache

Redis 8.0.3-alpine service for WordPress object caching, configured with memory limits and healthcheck.

docker-compose.prod.yml:32-52

wordpress

vulnerable targetPHP application server

Custom-built WordPress container on Ubuntu 22.04 with PHP-FPM 8.1, vulnerable glibc 2.35, Ghostscript 10.02.1, and BuddyForms 2.7.6 plugin. Exposes port 9000 for PHP-FPM. Runs with SYS_ADMIN, SYS_PTRACE capabilities and AppArmor unconfined for exploit development. Entrypoint script installs WordPress, activates plugins, and creates pages for exploitation.

docker-compose.prod.yml:54-93wordpress/Dockerfile.prod:1-150wordpress/entrypoint.prod.sh:1-402

nginx

reverse proxyTLS termination

Nginx 1.29.8-alpine reverse proxy serving WordPress over HTTP/HTTPS, with SSL termination, security headers, and static file serving.

docker-compose.prod.yml:95-120nginx/conf.d/wordpress.prod.conf:1-138

certbot

SSL certificate management

Certbot v4.2.0 for Let's Encrypt SSL certificate issuance and renewal, run on demand.

docker-compose.prod.yml:122-133

setup.sh

deployment automation

Bash script to automate deployment of the lab in local or production mode, including Docker installation, .env generation, nginx config generation, and container startup.

setup.sh:1-756

clean.sh

cleanup automation

Bash script to tear down Docker containers, volumes, and generated files for the lab.

clean.sh:1-175

cve=2024-2961.py

exploit script

Python exploit script (CNEXT) for CVE-2024-2961, implementing a PHP file-read to RCE via glibc iconv buffer overflow. Targets the lab's WordPress admin-ajax.php endpoint.

exploit/cve=2024-2961.py:1-576

gs-convert-file.php

vulnerable AJAX handler

WordPress mu-plugin providing an AJAX endpoint to convert uploaded PS/EPS/PDF files to images using Ghostscript. Intentionally calls ghostscript with -dSAFER to demonstrate CVE-2024-29510 format string vulnerability.

wordpress/mu-plugins/gs-convert-file.php:1-64
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-26326

Insufficient evidence

CVE-2023-26326 is mentioned in the Compose file header and README but no vulnerable component, exploit, or reproduction path for this CVE is visible in the supplied evidence. The BuddyForms plugin version 2.7.6 is installed, but no deserialization attack vector is configured or demonstrated.

docker-compose.prod.yml:4README.md:5

CVE-2024-29510

Supported by supplied evidence

The environment installs Ghostscript 10.02.1, a version known to be affected by CVE-2024-29510. A custom WordPress mu-plugin (gs-convert-file.php) provides an AJAX endpoint that executes Ghostscript with -dSAFER on user-uploaded PostScript files, explicitly documented as a trigger for the format string vulnerability. The Dockerfile and entrypoint script configure the vulnerable Ghostscript and the upload conversion page.

wordpress/Dockerfile.prod:1-6wordpress/Dockerfile.prod:100-120wordpress/mu-plugins/gs-convert-file.php:1-64wordpress/entrypoint.prod.sh:1-3

CVE-2024-2961

Supported by supplied evidence

The environment installs glibc 2.35-0ubuntu3, the vulnerable version for CVE-2024-2961. The BuddyForms plugin is installed, providing an unauthenticated AJAX endpoint (upload_image_from_url) used by the included exploit script (cve=2024-2961.py) to achieve file read and RCE via the iconv buffer overflow. The exploit script is present and targets the lab's own WordPress instance.

wordpress/Dockerfile.prod:1-6wordpress/Dockerfile.prod:30-38exploit/cve=2024-2961.py:1-4exploit/cve=2024-2961.py:40-50
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker Engine with Compose plugin installed on the host.setup.sh:100-130
  • Ubuntu 22.04 host OS (recommended, with warning for others).setup.sh:80-98
  • For production mode: a public IP address, a domain name, and DNS pointing to the host.setup.sh:50-55
  • Required passwords and configuration supplied via command-line arguments or .env file.setup.sh:40-55
  • WordPress container runs with SYS_ADMIN, SYS_PTRACE capabilities and AppArmor unconfined for exploit development.docker-compose.prod.yml:88-92

Evidence-described exercise path

  1. Deploy the lab using setup.sh with appropriate mode and parameters.setup.sh:1-15
  2. For CVE-2024-2961: Run the exploit script cve=2024-2961.py against the lab's WordPress URL, providing a command to execute.exploit/cve=2024-2961.py:1-4exploit/cve=2024-2961.py:40-50
  3. For CVE-2024-29510: Upload a crafted PostScript file via the 'Convert PostScript to Image' page to trigger the Ghostscript format string vulnerability.wordpress/mu-plugins/gs-convert-file.php:1-64wordpress/entrypoint.prod.sh:200-280
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the lab's own WordPress container. The exploit script attacks the lab's admin-ajax.php endpoint, and the Ghostscript handler processes uploads within the container. The WordPress container runs with elevated capabilities (SYS_ADMIN, SYS_PTRACE, AppArmor unconfined) which are documented prerequisites for the exercise and do not by themselves indicate host compromise. No evidence of host persistence, credential theft, data destruction, unexplained external payloads, or backdoor behavior is present.

exploit/cve=2024-2961.py:40-50wordpress/mu-plugins/gs-convert-file.php:1-64docker-compose.prod.yml:88-92
Review boundaries

What the analysis did not establish

  • The exploit script cve=2024-2961.py imports external Python modules (pwn, ten) not included in the packet; their behavior is uninspected.
  • CVE-2023-26326 is mentioned but no exploit or vulnerable path is visible.
  • The README is mostly placeholder text ('soon') and does not provide complete documentation.
  • The production nginx config contains placeholder strings (<SERVER-PUBLICIP>, <DOMAIN_NAME>) indicating it is a template, not a final runnable config.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2