Loading vulnerability…
CVE-2026-6433 affects the Custom CSS JS & PHP WordPress plugin through version 2.0.7. The vulnerability is caused by improper sanitization of user-supplied input before it is incorporated into a SQL query in the plugin’s AJAX handling path associated with action=fc_ajax_call and operation=wce_editor_inline_code. The result of the unsafe query flow is then passed to eval(), creating a path from SQL injection to arbitrary PHP execution. An unauthenticated remote attacker can exploit this flaw to inject PHP code that is executed by the server and can be used to write additional server-side payloads such as webshells.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a working Python proof-of-concept exploit for CVE-2026-6433 targeting the WordPress plugin FlipperCode Custom CSS, JS & PHP <= 2.0.7. The main script, CVE-2026-6433.py, is a standalone stdlib-only exploit that supports both single-target and multithreaded bulk operation. Its flow is: normalize target URL, probe /wp-admin/admin-ajax.php with action=fc_ajax_call&operation=processor to confirm the plugin surface, deliver a SQL injection in the id parameter to operation=wce_editor_inline_code using a UNION SELECT that embeds hex-encoded PHP, then retrieve a proof/output file written into the target web root. The exploit can either write a benign proof file with host metadata or execute an arbitrary attacker-supplied shell command and store the output in that file. It also supports cleanup by sending a PHP unlink payload to remove the proof artifact. The exploit is operational rather than a simple detector because it performs end-to-end exploitation and supports arbitrary command execution when PHP execution functions are available. It disables TLS verification, uses urllib for HTTP requests, and returns success based on the presence and contents of the proof file. Bulk mode reads targets from a local file and processes them concurrently with ThreadPoolExecutor. README.md documents the vulnerability, usage, flags, and exploit chain. The third file, as.txt, is unrelated to the Python PoC’s execution path and appears to be a PHP file manager/webshell-like utility. It supports browsing directories, uploading files, creating/editing files, renaming items, chmod changes, deletion, and downloads via GET/POST parameters. This file materially increases the malicious capability present in the repository, but it is not invoked by the Python exploit script itself.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A specific vulnerability in the Custom CSS JS PHP WordPress plugin cited as part of the set of CVEs weaponized by the access-brokerage operation.
A vulnerability in the Custom CSS JS PHP plugin listed among the flaws targeted by the operation.
A vulnerability in the Custom CSS JS PHP WordPress plugin that was directly targeted in the WP-SHELLSTORM campaign.
A SQL injection to remote code execution vulnerability in the WordPress Custom CSS JS & PHP plugin that the actor used to write persistent PHP shells.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.