This repository contains a production‑grade PoC that automates the entire attack chain – from fetching a valid nonce to uploading a webshell – with robust error handling and a beautiful CLI interface.

🔍 Key Features

• Truly unauthenticated – no WordPress credentials or session cookies required.
• Automatic nonce extraction – the exploit retrieves the necessary security nonce via the same public AJAX interface.
• Multipart file upload – correctly crafts the certificate_crt_path file parameter expected by the vulnerable handler.
• Direct URL generation – immediately provides the public URL of the uploaded payload.
• Post‑exploitation checks – optional verification of upload success and on‑the‑fly command execution (--check).
• Advanced error handling – gracefully deals with Cloudflare, WAFs, timeouts, and malformed responses.
• Clean, informative output – all messages are prefixed with [ * ], [ + ], [ - ], [ ! ] for instant readability.

🧬 Vulnerability Details

The root cause lies in two AJAX actions registered by the plugin:

1. lkn_pix_for_woocommerce_generate_nonce

This action is hooked into wp_ajax_nopriv_*, making it accessible to unauthenticated visitors. It generates a nonce for the lkn_pix_for_woocommerce_c6_settings_nonce action and returns it in a JSON envelope:

No capability check or user authentication is performed – anyone can request a valid nonce.

2. lkn_pix_for_woocommerce_c6_save_settings

This handler saves plugin settings, including a file upload field named certificate_crt_path. Although the upload occurs through WordPress’s media_handle_upload helper, the plugin does not:

• Verify that the request is coming from an authenticated, authorised user (missing current_user_can).
• Enforce any file type or extension restrictions (e.g., allows .php files).
• Store the file in a non‑executable location – it ends up in:
  root@kitploit:~

  wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/
  

  which is directly accessible via the web.

Because the nonce only protects against CSRF, and it can be obtained by anyone, an attacker can chain these two actions to upload and execute arbitrary PHP code.

Affected Versions

• Pix for WooCommerce versions ≤ 1.5.0
• The vulnerability has been confirmed on clean WordPress installs with default configurations.

Impact

• Remote Code Execution – full webshell access with the privileges of the web server (typically www-data or apache).
• Data exfiltration – read wp-config.php, database credentials, customer data.
• Persistence – modify core files, plant backdoors.
• Complete site takeover – escalate to WordPress admin if the database is accessible.

🛠️ Exploitation Requirements

• Network access to the target WordPress site (no authentication needed).
• Python 3.8+ with the requests library (install via pip install requests).
• The target must have the vulnerable plugin installed and active (default configuration is sufficient).

🚀 Usage

Installation

Basic Command

For more control, use command‑line options:

Example Output

Command‑Line Options

🧪 Technical Details for Detection & Tuning

Nonce Generation Endpoint

• URL: http://target/wp-admin/admin-ajax.php
• Action: lkn_pix_for_woocommerce_generate_nonce
• Parameter: action_name=lkn_pix_for_woocommerce_c6_settings_nonce
• Response: {"success":true,"data":{"nonce":"..."}}
• Note: The nonce is always obtainable because the action is registered with wp_ajax_nopriv_*. No cookie or session is needed.

File Upload Parameters

• URL: Same admin-ajax.php
• Action: lkn_pix_for_woocommerce_c6_save_settings
• Required fields:
  • _ajax_nonce – the nonce retrieved earlier
  • certificate_crt_path – a multipart file upload (the payload)
• File type: The plugin does not validate the extension, so .php files are accepted and stored without renaming.

Public Storage Path

After successful upload, the file resides in:

This directory is directly web‑accessible; PHP files will be executed if the web server is configured to process them (which is the default for WordPress‑managed servers).

Indicators of Compromise (IoCs)

• Unexpected PHP files appearing in the certs_c6 directory (especially files like woocommerce.php, shell.php, etc.).
• Unusual admin-ajax.php POST requests with the actions listed above, originating from untrusted IPs.
• Access logs showing direct hits to .../certs_c6/ with query parameters like ?cmd=id.

🛡️ Detection & Mitigation

Detection

Monitor your WordPress logs for:

• Repeated POST requests to /wp-admin/admin-ajax.php with action=lkn_pix_for_woocommerce_generate_nonce and action=lkn_pix_for_woocommerce_c6_save_settings.
• Creation of new files in the certs_c6 folder. Use a file integrity monitoring tool (e.g., Tripwire, OSSEC) to alert on changes.
• Web server logs showing execution of PHP files in that directory from external IPs.

Mitigation

1. Update the plugin – check for version >1.5.0 that contains the official fix (if released).
2. Apply a virtual patch – block access to the vulnerable AJAX actions with a WAF rule (e.g., ModSecurity, Cloudflare WAF).
3. Restrict file execution – if the plugin is required, configure your web server to deny PHP execution inside the certs_c6 directory (e.g., using .htaccess with php_flag engine off).
4. Harden AJAX handlers – if you maintain the plugin, ensure that both actions are only accessible to authenticated and authorised users (current_user_can('manage_options') for the nonce generation, and a proper nonce verification plus capability check for the upload).
5. Disable the plugin – if Pix for WooCommerce is not essential, remove it entirely.

👏 Credits

• Exploit Development & PoC: Ch4120N
• Vulnerability Analysis: Independent security research

📄 License

This project is licensed under the MIT License – see the LICENSE file for details.

Disclaimer: This tool is intended for authorised security testing and educational use only. The author is not responsible for any misuse or damage caused by this software.

📚 References

• NIST NVD – CVE-2026-3891
• WordPress Plugin Repository – Pix for WooCommerce (check changelog for fixed versions)
• Patchstack / WPScan Vulnerability Database (if entry exists)

⭐ Support

If you find this PoC useful, consider giving it a ⭐ on GitHub and sharing it responsibly. Contributions, issues, and pull requests are welcome!

Happy hacking! 🛡️