Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
By-Poloss..-..CVE-2026-15038-POC — POC 4 CVE-2026-15038 | Kitploit
Tools/GitHubGitHub/polosss/by-poloss..-..cve-2026-15038-poc
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration TestingAuthentication
GitHubpolosss/by-poloss..-..cve-2026-15038-poc

By-Poloss..-..CVE-2026-15038-POC

POC 4 CVE-2026-15038

View Repository
1121 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🚨 CVE-2026-15038 — InfiniteWP Client Admin Takeover

Unauthenticated Admin Account Takeover in WordPress Multisite

CVE CVSS CWE WPScan

📋 Overview

InfiniteWP Client plugin for WordPress (< 1.13.6) contains a critical authentication bypass vulnerability affecting Multisite installations.

An unauthenticated attacker can:

  • 🔓 Bypass all authentication checks
  • 🔑 Bind their own cryptographic keys
  • 👑 Take over admin sessions
  • 💻
Achieve Remote Code Execution (RCE)
  • 🌐 Compromise the entire WordPress Network

    • 🔍 Root Cause Analysis

    🐛 Bug #1: Connection State Mismatch

    root@kitploit:~
    if (!$iwp_mmb_core->get_option('iwp_client_action_message_id') 
    && !$iwp_mmb_core->get_option('iwp_client_public_key'))
    • Reader: Uses get_site_option() → reads from network-level (wp_sitemeta)
    • Writer: Uses update_blog_option() → writes to per-blog (wp_X_options)

    💥 Result: On Multisite, the guard always returns false — re-pairing is always allowed.

    🐛 Bug #2: Activation Key Bypass

    root@kitploit:~
    if(trim($activation_key) != get_option('iwp_client_activate_key')){
    • After activation, the key is deleted → get_option() returns false
    • Attacker sends no activation_key → trim(null) → ''
    • PHP loose comparison: '' != false → false → Check passes 🎯

    🐛 Bug #3: Attacker-Controlled Keypair

    • Attacker generates their own RSA keypair
    • Signs requests themselves → openssl_verify() passes
    • Plugin binds attacker's key to ALL blogs in the network

    🚀 Exploitation Chain

    root@kitploit:~
    graph LR
    A[Send POST Request] --> B[Add Site Action]
    B --> C[Guard Bypassed]
    C --> D[Activation Key Check Fails]
    D --> E[Signature Verifies]
    E --> F[Attacker Key Bound]
    F --> G[Full Admin Access]
    G --> H[RCE Achieved]

    💻 Installation

    root@kitploit:~
    # Clone the repository
git clone https://github.com/yourusername/CVE-2026-15038.git
cd CVE-2026-15038

# Install dependencies
pip install -r requirements.txt

    🎯 Usage

    Basic Single Target

    root@kitploit:~
    python3 exploit.py -t https://wordpress.ddev.site

    Mass Exploitation

    root@kitploit:~
    python3 exploit.py -t https://target1.com -t https://target2.com -t https://target3.com

    Custom Command Execution

    root@kitploit:~
    python3 exploit.py -t https://wordpress.ddev.site --command "wp plugin install hello-dolly --activate"

    Complete Attack Chain

    root@kitploit:~
    python3 exploit.py -t https://wordpress.ddev.site --takeover --rce

    📂 File Structure

    FileDescription
    exploit.py🐍 Main exploit script with mass exploitation support
    requirements.txt📦 Python dependencies
    README.md📖 This documentation

    ⚠️ Important Notes

    • ✅ Works on WordPress Multisite installations
    • ❌ Not effective on single-site installations
    • 🔒 Patched in InfiniteWP Client 1.13.6
    • 🔐 Always update to the latest version

    🛡️ Mitigation

    1. Immediate Action: Update to InfiniteWP Client ≥ 1.13.6
    2. Verify: Check for suspicious admin users
    3. Audit: Review recent add_site requests in logs
    4. Monitor: Watch for unusual plugin activity

    🔗 Resources

    • NVD Entry
    • WPScan Advisory

    ⚖️ Disclaimer

    This tool is for educational and security testing purposes only. Use only on systems you own or have explicit permission to test. The authors assume no liability for misuse.

    Download Tool