 ██████╗██╗   ██╗███████╗    ██████╗  ██████╗ ██████╗  ██████╗      
██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗╚════██╗██╔════╝      
██║     ██║   ██║█████╗       █████╔╝██║██╔██║ █████╔╝███████╗      
██║     ╚██╗ ██╔╝██╔══╝      ██╔═══╝ ████╔╝██║██╔═══╝ ██╔═══██╗     
╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝███████╗╚██████╔╝     
 ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝ ╚══════╝ ╚═════╝

CVE-2026-1555 — WebStack WordPress Theme RCE

WordPress WebStack Theme — Unauthenticated Remote Code Execution

For educational and authorized penetration testing only.

📌 Overview

CVE-2026-1555 is a critical vulnerability affecting the WebStack WordPress Theme that allows unauthenticated attackers to perform arbitrary file upload leading to Remote Code Execution (RCE) on the target server.

This toolkit (FriendsExploit) automates the discovery and exploitation of vulnerable targets using a clean PyQt5 GUI with integrated dork scanning.

Target Surface  →  WordPress sites running WebStack theme
Vuln Type       →  Unauthenticated Arbitrary File Upload → RCE
CVSS Score      →  9.8 (Critical)
Auth Required   →  None
Payload         →  ms.php (Multi-feature PHP Webshell)

📁 Project Structure

CVE-2026-1555-Linux/
│
├── CVE-2026-1555.py          # Main exploit tool (PyQt5 GUI)
├── ms.php                    # PHP webshell payload
├── Dork.txt                  # Fofa/Shodan dork for target discovery
├── requirements.txt          # Python dependencies
└── README.md                 # You are here

⚙️ Requirements

Requirement	Version
Python	3.8+
PyQt5	≥ 5.15.0
requests	≥ 2.31.0
urllib3	≥ 2.0.0

🚀 Setup & Installation

Step 1 — Clone the Repository

git clone https://github.com/YOUR_USERNAME/CVE-2026-1555-Linux.git
cd CVE-2026-1555-Linux

Step 2 — Create Virtual Environment (recommended)

python3 -m venv venv
source venv/bin/activate

Step 3 — Install Dependencies

pip install -r requirements.txt

Kali / Debian users — if PyQt5 fails via pip, install system-wide first:
sudo apt install python3-pyqt5 -y

Step 4 — Run the Tool

python3 CVE-2026-1555.py

The GUI will launch. Load targets manually or use the built-in dork scanner.

🐚 Webshell — `ms.php`

After successful exploitation, the tool uploads ms.php to the target.

Access

https://target.com/wp-content/themes/WebStack/ms.php

Default password: fr13nds2026

Webshell Features

Reverse Shell Setup

On your machine start a listener:

nc -lvnp 4444

In the webshell REVSHELL tab → enter your IP and port → hit FIRE.

🔎 Target Discovery (Dork)

Fofa / Shodan dork (from Dork.txt):

body="wp-content/themes/WebStack"

Paste into Fofa or Shodan to enumerate vulnerable targets.

🔬 Vulnerability Details

Attack Flow

[1] Discover target via dork scan
        ↓
[2] Confirm WebStack theme installation
        ↓
[3] Trigger vulnerable upload endpoint (no auth required)
        ↓
[4] Upload ms.php payload to webroot
        ↓
[5] Access webshell → achieve RCE
        ↓
[6] Escalate: dump DB creds, pivot, revshell

🛠️ Troubleshooting

PyQt5 display error on headless server:

export DISPLAY=:0
# or use Xvfb
sudo apt install xvfb -y
Xvfb :0 -screen 0 1024x768x24 &
export DISPLAY=:0
python3 CVE-2026-1555.py

pip install fails for PyQt5:

sudo apt install python3-pyqt5 python3-pyqt5.qtwebengine -y

Permission denied running script:

chmod +x CVE-2026-1555.py
python3 CVE-2026-1555.py

requests/urllib3 SSL errors:

pip install --upgrade requests urllib3 certifi

📋 Quick Run (One-liner)

git clone https://github.com/YOUR_USERNAME/CVE-2026-1555-Linux.git && \
cd CVE-2026-1555-Linux && \
python3 -m venv venv && source venv/bin/activate && \
pip install -r requirements.txt -q && \
python3 CVE-2026-1555.py

⚠️ Disclaimer

This tool is intended for authorized security research and penetration testing 
only. The authors are not responsible for any misuse or damage caused by this 
program. Only use against systems you own or have explicit written permission 
to test. Unauthorized use is illegal.

FriendsExploit • CVE-2026-1555 • Linux Edition

Built for researchers. Use responsibly.

🖥️ SYSINFO	PHP version, OS, current user, safe mode status, server vars
💻 TERMINAL	Full command execution with live output — supports 6 exec methods
📂 FILES	Read / Write / Edit / Delete / Download any file on the server
📤 UPLOAD	Upload files to any path or fetch remote files via `wget`/`curl`
🔄 REVSHELL	One-click reverse shell fire + prebuilt bash/python3/perl/nc/php shells
🗄️ DB SCAN	Auto-detect `wp-config.php`, dump DB credentials, manual MySQL runner

CVE ID	CVE-2026-1555
Affected Software	WebStack WordPress Theme
Vulnerability Type	Unauthenticated Arbitrary File Upload → RCE
Attack Vector	Network
Authentication	Not Required
CVSS v3 Score	9.8 Critical
Affected Versions	All versions prior to patch

Most Popular

WG-CVE-2026-1555-Linux