murrez/cve-2026-0911Authenticated PoC for CVE-2026-0911: tests weak file upload and orphan file behavior in WordPress Hustle plugin's module import endpoint, with multi-target scanning and payload customization.
A research / pentest helper tool that tests the upload behavior via the authenticated module import endpoint for the WordPress plugin Hustle (wordpress-popup, WPMU DEV) under CVE-2026-0911.
The CVE-2026-0911.py script in this repository or file set should only be used on systems you own or have explicit written permission to test.
In affected versions (Wordfence/NVD: 7.8.9.2 and earlier), the wp_handle_upload() call inside action_import_module() is made with test_type => false, leaving file type validation weak; even if JSON validation fails after import, the uploaded file may not be deleted ("orphan" file). If the server executes PHP under wp-content/uploads, this can be part of a chain leading to remote code execution in practice. Patched versions introduce and a restriction via temporary .
test_type => true.jsonupload_mimesSee the NVD record and Wordfence references for a detailed technical summary.
from __future__ import annotations)Example installation:
pip install requests
At least one target (-u or -l) and a valid WordPress session (--cookie or --cookie-file) are required.
python CVE-2026-0911.py -u "https://example.com" --cookie "wordpress_logged_in_...=...; ..."
Help:
python CVE-2026-0911.py --help
| Parameter | Description |
|---|---|
-u, --url | Single target root URL (e.g. https://site.com) |
-l, --list | File containing one URL per line (# for comments) |
--cookie | Cookie string copied from the browser |
--cookie-file | File holding the cookie on a single line |
--nonce | Manually supplied WordPress nonce for hustle_single_action (instead of automatic retrieval) |
--admin-page | admin.php?page= value from which the nonce is fetched (default: hustle_popup_listing) |
--module-id | POST moduleId (default 0: invalid module → import flow) |
--module-type | popup, slidein, embedded, social_sharing |
--module-mode | E.g. informational, optin |
--remote-name | Filename sent in the multipart (default: probe_rce.php) |
--payload-file | Read payload content from a file (overrides --uploader and the default probe) |
--uploader | Use the built-in mini PHP form-uploader body |
--workers | Number of concurrent threads in list mode (default: 8) |
--timeout | Request timeout in seconds (default: 25) |
--verify-ssl | Enable TLS verification (default: off) |
--debug | Additional debug output |
--quiet | Disable domain/step logs; summary-focused |
admin-ajax.php POST summary, possible candidate URLs. With multiple targets, lines may appear interleaved since they come from threads; each line includes the target domain.--quiet suppresses these details.-o file, written to disk with flush / fsync where possible. Default filename: cve-2026-0911-hits.txt (absolute path in the working directory is summarized).Single site, TLS verification, debugging:
python CVE-2026-0911.py -u "https://lab.local" --cookie-file cookie.txt --verify-ssl --debug
List scan, 16 workers, custom output:
python CVE-2026-0911.py -l targets.txt --cookie "..." --workers 16 -o results.txt
Built-in uploader body and custom remote filename:
python CVE-2026-0911.py -u "https://lab.local" --cookie "..." --uploader --remote-name test.php
single_module_action_nonce field inside optinVars.moduleId=0 path, the plugin may return an error due to module limits before uploading; in that case the file is not written.wp-content/uploads/YYYY/MM/ assumption; if WordPress renames the file, the actual path may differ.--cookie does not work across different domains; multi-site testing requires an appropriate session for each environment.0 if at least one "hit" is successful, non-zero otherwise (script-internal main return).Ctrl+C: 130.This tool is intended for legal security testing, education, and defensive purposes only. Use on unauthorized systems is illegal and may lead to severe penalties. The authors and contributors cannot be held responsible for misuse.
-o, --output | File to which successful "hit" lines are appended |