EIP-2026-113678

PRE-CVE

WordPress Plugin CYSTEME Finder 1.3 - Arbitrary File Disclosure/Arbitrary File Upload

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-113678. PoCs published by T0w3ntum.

AI-analyzed exploit summary The exploit demonstrates arbitrary file disclosure and upload vulnerabilities in the WordPress CYSTEME Finder Plugin 1.3 due to insufficient cookie validation in the connector.php endpoint. Attackers can traverse directories, download files, and upload malicious files by manipulating the 'wphome' parameter and using directory hashes.

Description

WordPress Plugin CYSTEME Finder 1.3 - Arbitrary File Disclosure/Arbitrary File Upload

Exploits (1)

exploitdb WORKING POC VERIFIED
by T0w3ntum · textwebappsphp
https://www.exploit-db.com/exploits/40295

The exploit demonstrates arbitrary file disclosure and upload vulnerabilities in the WordPress CYSTEME Finder Plugin 1.3 due to insufficient cookie validation in the connector.php endpoint. Attackers can traverse directories, download files, and upload malicious files by manipulating the 'wphome' parameter and using directory hashes.

Classification
Working Poc 95%
Attack Type
Info Leak | Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: WordPress CYSTEME Finder Plugin 1.3
No auth needed
Prerequisites: Access to the target WordPress site with the vulnerable plugin installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026