EIP-2026-111337

PRE-CVE

Pligg CMS 2.0.0rc2 - Cross-Site Request Forgery (File Creation)

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-111337. PoCs published by DaOne.

AI-analyzed exploit summary This is a functional CSRF exploit for Pligg CMS that creates a malicious PHP file on the target server. The exploit leverages a CSRF vulnerability in the admin panel to write a backdoor file containing arbitrary command execution code.

Description

Pligg CMS 2.0.0rc2 - Cross-Site Request Forgery (File Creation)

Exploits (1)

exploitdb WORKING POC VERIFIED

by DaOne · textwebappsphp

https://www.exploit-db.com/exploits/27600

View Code ZIP pw:eip

This is a functional CSRF exploit for Pligg CMS that creates a malicious PHP file on the target server. The exploit leverages a CSRF vulnerability in the admin panel to write a backdoor file containing arbitrary command execution code.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Pligg CMS 2.0.0rc2 and older versions

Auth required

Prerequisites: Target must be logged into the admin panel · CSRF protection must be bypassed (e.g., via Live HTTP Headers or Tamper Data)

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026