Loading vulnerability…
CVE-2026-6433 is an unauthenticated server-side code execution vulnerability in the Custom css-js-php WordPress plugin affecting versions through 2.0.7. The plugin does not properly sanitize user-supplied input before incorporating it into a SQL query, and the resulting data is subsequently passed to eval(). This unsafe combination of insufficient input neutralization and dynamic code evaluation allows an external attacker to supply crafted input that leads to arbitrary PHP execution within the WordPress application context on the server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a working Python proof-of-concept exploit for CVE-2026-6433 targeting the WordPress plugin FlipperCode Custom CSS, JS & PHP <= 2.0.7. The main script, CVE-2026-6433.py, is a standalone stdlib-only exploit that supports both single-target and multithreaded bulk operation. Its flow is: normalize target URL, probe /wp-admin/admin-ajax.php with action=fc_ajax_call&operation=processor to confirm the plugin surface, deliver a SQL injection in the id parameter to operation=wce_editor_inline_code using a UNION SELECT that embeds hex-encoded PHP, then retrieve a proof/output file written into the target web root. The exploit can either write a benign proof file with host metadata or execute an arbitrary attacker-supplied shell command and store the output in that file. It also supports cleanup by sending a PHP unlink payload to remove the proof artifact. The exploit is operational rather than a simple detector because it performs end-to-end exploitation and supports arbitrary command execution when PHP execution functions are available. It disables TLS verification, uses urllib for HTTP requests, and returns success based on the presence and contents of the proof file. Bulk mode reads targets from a local file and processes them concurrently with ThreadPoolExecutor. README.md documents the vulnerability, usage, flags, and exploit chain. The third file, as.txt, is unrelated to the Python PoC’s execution path and appears to be a PHP file manager/webshell-like utility. It supports browsing directories, uploading files, creating/editing files, renaming items, chmod changes, deletion, and downloads via GET/POST parameters. This file materially increases the malicious capability present in the repository, but it is not invoked by the Python exploit script itself.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in the Custom CSS JS PHP plugin listed among the flaws targeted by the operation.
A vulnerability in the Custom CSS JS PHP WordPress plugin that was directly targeted in the WP-SHELLSTORM campaign.
A SQL injection to remote code execution vulnerability in the WordPress Custom CSS JS & PHP plugin that the actor used to write persistent PHP shells.
A vulnerability identified as CVE-2026-6433 associated in the content with FlipperCode Custom CSS, JS & PHP plugin versions <= 2.0.7. No technical details about the flaw type or impact are provided in the content.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.