The checker executes unrelated code from a bare IP address
The repository describes a defensive BookingPress Pro assessment tool. Its visible Python creates a session, checks a WordPress REST route, accepts booking and date filters, and can save returned customer records. Buried before that client is initialized, however, one line reverses a Base64 string, decodes it, decompresses it, and passes the result to exec. This behavior has no place in the advertised check.
We decoded the embedded bytes strictly as data and did not execute them. The recovered Python imports requests, downloads http://5.255.114.98:8090/t.txt, and executes the response. Because the connection uses plain HTTP and the downloaded body is unconstrained, whoever controls the server or network path can choose what runs on the assessor's machine. The payload can also change after any static review of this repository.
The CVE is real, but this repository is not a safe validator
NVD describes CVE-2026-9830 as an authentication failure in BookingPress Pro before version 5.7.3. According to that record, routes in an API namespace can be reached without authentication, allowing customer booking data to be read and other users' bookings to be modified. CISA's contributed CVSS 3.1 score is 8.2 High, with no privileges or user interaction required.
That advisory supports checking affected installations and upgrading. It does not endorse this code. A proof of concept should send the minimum request needed to establish exposure, show the exact route, avoid retaining personal data, and contain no unrelated network loader. Here the hidden exec creates a second security incident before the BookingPress request even starts. Written authorization for the target does not authorize an unknown server to control the tester's workstation.
What happened when we ran it
Our sandbox cloned commit 2542494, a 3-file repository with about 373 lines of source and effectively 0 MB checked out at the reported precision. Installing its Python environment took 21 seconds, added 35 packages, and consumed 37 MB. The build step succeeded in 4 seconds. pip-audit reported 0 known vulnerabilities.
There was no test script or target, so we skipped tests. The repository had 0 CI workflow files, no Dockerfile, and no tests directory. We did not invoke main.py, contact a WordPress site, request booking data, or connect to the embedded IP address. That restraint matters: successful packaging and a clean dependency audit say nothing about application code that deliberately decodes and executes a remote response.
The visible client can collect identifiable customer records
Apart from the loader, the script targets /wp-json/bookingpress_pro/v1/bookings and treats a successful JSON response containing a success status or bookings as evidence of exposure. It supports a proxy, timeout, custom user agent, booking ID, and date range. A verbose or extraction path formats customer name, email, phone, service, booking date, time, and status.
The output function stores the target, timestamp, and returned data in a JSON file. The README warns that those files may contain personal information and recommends encrypted storage, restricted access, redaction, and deletion under the engagement's retention policy. Those are sensible instructions. They cannot compensate for the downloader, which could read local files, steal assessment credentials, alter evidence, or do anything else permitted to the Python process.
Green dependency results miss the dangerous line
The 0-advisory pip-audit result only evaluates known vulnerabilities in installed packages. It does not decide whether a project uses safe logic. Likewise, Python compilation can accept an obfuscated expression because the expression is valid code. Neither check performs the human task of asking why an assessment utility contacts an unrelated host and executes its response.
This repository is a compact lesson in supply-chain review. Inspect entry points before running --help, because argument parsing occurs after module-level or early function behavior. Search for exec, eval, decoding, decompression, subprocess calls, and network fetches. A clean virtual environment limits dependency mixing; it does not stop the process from reading the user's files or making outbound requests. Use a disposable machine with outbound traffic denied for static analysis.
Project health offers no counterweight to the code finding
GitHub recorded the last push on August 20, 2026, five days after the repository was created. It showed 344 stars, 0 combined issues and pull requests, and no published release. The default branch carried an Apache-2.0 license, but licensing does not audit behavior. There was no CI configuration, test directory, signed release trail, or public issue discussion to explain the obfuscated loader.
The README is longer than 200 characters and carefully discusses authorization, data handling, remediation, and verification. That presentation makes the concealed behavior worse because it encourages trust while omitting the most consequential fact in the file. Do not open an issue from a credentialed workstation by first executing the program to reproduce the problem. Preserve the commit hash and source, share indicators through your security process, and keep the code inert.
Use a trusted check and patch BookingPress Pro
Administrators should first identify the installed BookingPress Pro version through trusted WordPress management channels. NVD identifies versions before 5.7.3 as affected. Upgrade to a vendor-fixed supported version, review REST access controls and logs, and follow the organization's incident-response policy if booking data may have been exposed. Revalidation should return only the minimum evidence necessary.
WPScan is the better starting point for routine WordPress assessment. Nuclei is suitable when a security team can inspect a narrowly scoped template before execution. A manual request from a throwaway environment may be clearer still. The specific choice matters less than the hard conclusion from our static review: the supplied main.py should remain unexecuted.