murrez/cve-2026-6433

CVE-2026-6433 is a proof-of-concept security research script that demonstrates a vulnerability in the FlipperCode Custom CSS, JS & PHP WordPress plugin, affecting versions up to and including 2.0.7. The vulnerability allows an attacker who is not logged in to exploit a SQL injection flaw, a type of attack where malicious database commands are smuggled through a web form or request, and use it to achieve remote code execution, meaning arbitrary code can be run on the server hosting the WordPress site. The script is written in Python and uses only the standard library, so no additional packages need to be installed. It operates in two modes: single-target mode, where you point it at one site, and bulk mode, where you supply a text file of URLs and the script tests them concurrently using multiple threads. Various command-line flags control behavior such as running a shell command on the remote host, writing a proof file to the server, skipping automatic cleanup of that file, or running cleanup only. The exploit chain works by sending a specially crafted request to the plugin's admin-ajax.php endpoint, injecting a PHP payload via the SQL flaw, having that payload written to the server's document root, and then optionally fetching the result or running a command through it. This tool is intended strictly for authorized security testing, defensive research, and education. Running it against systems without explicit written permission may violate computer misuse laws.