MyBB Limited ACP to Full Admin Privilege Escalation PoC Detection

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•2

Detects the presence and execution of the 'mybb_limited_acp_to_admin' PoC script, as well as suspicious child process creation originating from web server or PHP processes when the command line includes 'admincp'. This is indicative of potential web exploitation or the use of a web shell within the MyBB Administrative Control Panel environment.