CVE-2026-23550 PoC

A small Bash tester for CVE-2026-23550. It requests the affected WordPress modular connector login endpoint, checks whether a wordpress_logged_in_ cookie is issued, and attempts to confirm access to the admin dashboard.

Warning: Use this tool only against systems you own or have explicit authorization to test. Unauthorized security testing may be illegal and disruptive.

Requirements

• Bash 4+
• curl
• grep
• mktemp

Usage

Make the script executable:

chmod +x cve-2026-23550-poc.sh

Scan the default local target (http://localhost:8080):

./cve-2026-23550-poc.sh

Scan one target using either the option or the backwards-compatible positional form:

./cve-2026-23550-poc.sh --target https://example.com
./cve-2026-23550-poc.sh https://example.com

Scan a list of targets:

./cve-2026-23550-poc.sh --list targets.txt

The list must contain one complete base URL per line. Blank lines and comments beginning with # are ignored:

# Authorized test systems
http://localhost:8080
https://staging.example.com

Short options are also supported:

./cve-2026-23550-poc.sh -t https://example.com
./cve-2026-23550-poc.sh -l targets.txt

Run ./cve-2026-23550-poc.sh --help for the complete command reference.

Results

• VULNERABLE - admin cookie issued means the endpoint returned a WordPress login cookie.
• Admin dashboard access confirmed means the cookie also allowed the script to retrieve a page containing the dashboard marker.
• No admin cookie means the expected login cookie was not found; this alone does not prove the target is fully patched.
• List scans end with counts for scanned targets, vulnerable responses, responses without the cookie, and request errors.

Network requests use a 5-second connection timeout and a 15-second total timeout. Redirects (for example http → https or trailing-slash normalization) are followed so the request reaches the actual endpoint, and any issued cookies are captured. Cookie jars are stored in temporary files and removed after each target.

Credits

• Vulnerability research and write-up: CVE-2026-23550: Critical Privilege Escalation in WordPress Modular DS Plugin (CVSS 10) — Abu Hurayra