Unauthenticated arbitrary file upload in Elementor Pro Forms

Repository contains a working exploit chain for CVE-2026-32475, targeting Elementor Pro <= 4.2.1 on WordPress. Although the repo includes a Nuclei template (CVE-2026-32475.yaml), it also ships a standalone Python exploit (el_rce_poc.py) that performs full exploitation rather than mere detection. The exploit abuses inconsistent handling of multiple uploaded files in Elementor Forms: an empty first file entry causes validation() to stop early, while process_field() continues and moves a second malicious .php file into the public uploads directory. The Python PoC first fetches a form page to scrape post_id, form_id, and optionally the upload field ID; then it submits a crafted multipart POST to /wp-admin/admin-ajax.php with two parts for the same upload field. The payload is a PHP webshell that prints a marker and executes shell commands from the X-CMD header. After upload, the script attempts to recover the generated filename by predicting PHP uniqid()-based names and probing /wp-content/uploads/elementor/forms/YYYY/MM/<candidate>.php concurrently until it finds the shell. Repository structure: README.md explains the vulnerability, attack flow, usage, and lab setup; analysis.md documents the uniqid() filename prediction logic; docker-compose.yml builds a local WordPress/MariaDB lab; setup_form_page.php creates a published Elementor form page with a file upload field for testing; CVE-2026-32475.yaml is a Nuclei template that validates the arbitrary upload condition by checking that the server response indicates failure without the expected file-type rejection. Overall, this is a real exploit repository with both detection/template content and an operational unauthenticated file-upload-to-RCE PoC.

This repository is a small standalone Python proof-of-concept exploit for CVE-2026-32475 affecting Elementor Pro <= 4.2.1 on WordPress. The repo contains only three files: a standard .gitignore, a README describing the vulnerability and usage, and the main exploit script pocel.py. The exploit is not part of a larger framework. The script automates exploitation of an unauthenticated arbitrary file upload in Elementor Pro forms. It first fetches a target page containing an Elementor form and uses regex to extract required identifiers such as post_id, form_id, and the upload field ID. It then submits a crafted multipart request to /wp-admin/admin-ajax.php using the Elementor action elementor_pro_forms_send_form. The multipart body contains two entries for the same upload field: an empty file part followed by a PHP payload. According to the README and code logic, this abuses inconsistent handling of empty upload entries during validation versus processing, allowing the PHP file to be moved into a web-accessible uploads directory. The payload is a simple PHP web shell that executes commands from the GET parameter c via system(). After upload, the script attempts to locate the generated PHP file by scanning a hardcoded local Laragon filesystem path (C:\laragon\www\wp\wp-content\uploads\elementor\forms). This means the PoC is fully operational in the author's local lab, but remote filename recovery is not automated in the script. Once a shell path is found, the script converts it to a URL under /wp-content/uploads/elementor/forms/ and either runs a single command or opens an interactive command loop. Overall capability: unauthenticated web exploitation leading to arbitrary PHP upload and RCE. Limitation: as written, remote exploitation is incomplete unless the operator can independently determine the generated filename or has local access to the uploads directory.

This seven-file repository is an operational Python proof of concept for CVE-2026-32475, an unauthenticated arbitrary-file-upload vulnerability claimed to affect Elementor Pro Forms through version 4.2.1. The main entry point, script.py, discovers or accepts a public page containing an Elementor form, scrapes its post ID, form ID, upload-field identifier, and required fields, then submits a multipart request containing an empty file part followed by a PHP payload for the same upload field. This abuses the differing validation and processing behavior described in the README: validation returns early for the empty optional part while processing skips that part and moves the subsequent PHP file. The script estimates and brute-forces the uniqid()-based generated filename using response timing and parallel keep-alive probes, then executes a configurable command through the recovered webshell. It can optionally remove that shell and can process batch target lists and write JSON reports. banner.py supplies terminal branding. setup_form_page.php creates a deliberately vulnerable Elementor form page for testing. docker-compose.yml defines an isolated WordPress/MariaDB lab exposed at localhost:8090, while the README documents installation of a legally obtained vulnerable Elementor Pro package and exploit operation. No third-party exploitation framework is used; the payload is a hardcoded but command-configurable PHP webshell.

This 11-file repository is an operational Docker lab and Python proof of concept for a claimed CVE-2026-32475 Elementor Pro Forms validation flaw. Its primary exploit entry point, poc.py, sends two multipart parts for one optional file-upload form field: an empty first part causes validation() to return early, while a second shell.php part is still processed and moved by process_field(). This bypasses the extension blocklist and writes PHP under the Elementor forms uploads directory. The PoC then derives candidate filenames from PHP uniqid() format using the response Date header and concurrently probes them; upon finding its marker, it supplies a user-selected command through the shell's c query parameter to obtain RCE. The repository contains Bash automation to clone an Elementor Pro source mirror, derive a patched twin by replacing the vulnerable return with continue, start two WordPress 7.4 Apache/MariaDB stacks, and install a test page containing an optional upload field. setup_page.php creates that intentionally vulnerable form configuration. verify.sh independently checks, from inside the containers, whether a PHP shell was written and whether it executes on the vulnerable instance, while confirming the same request is blocked by the patched instance. The README, Docker Compose configuration, and captured transcript document the A/B lab design. It is not tied to an exploit framework; the shell payload and command are directly implemented in Python/PHP.

This two-file repository consists of an extensive README and a Python 3 PoC, cve-2026-32475-poc.py. It targets CVE-2026-32475 in Elementor Pro Forms through an unauthenticated multipart upload-validation bypass. The script first requests a user-supplied page and extracts post_id, form_id, queried_id, a file-field custom ID, and optionally text/email fields from HTML. It then POSTs to the WordPress admin AJAX handler with action=elementor_pro_forms_send_form and two entries for the same upload field: an empty first file followed by a PHP payload. This is intended to trigger early validation return for the empty entry while allowing the second entry to be stored without extension enforcement. The default payload is a marker-only PHP file; optional modes accept a custom local payload or generate an obfuscated PHP shell using the vapcom GET parameter for command execution. It classifies responses as vulnerable, patched/blocked, unknown, or error, supports target lists and CSV output, and includes a brute-force confirmation mode for the server-generated uniqid()-style filename in wp-content/uploads/elementor/forms/. No established exploit framework is used. The README documents usage, mitigation, compromise-hunting guidance, and states that Elementor Pro 4.2.2 fixes the issue.

This small repository contains one primary Python 3 exploit script, a generic GitHub Actions Python lint/test workflow, and a minimal README. CVE-2026-32475.py targets a claimed unauthenticated file-upload flaw in Elementor Pro forms on WordPress. It retrieves a supplied form page, regex-extracts Elementor form identifiers and a file-upload field, then posts a multipart form submission to WordPress's admin AJAX endpoint using the Elementor Pro form action. The script can process one target or a target list, accepts overrides for extracted identifiers, uses concurrent-capable HTTP session configuration, records results in CSV, and distinguishes apparent extension filtering from successful or indeterminate responses. Default behavior uploads a harmless PHP marker token; optional modes accept a local payload or create an obfuscated PHP command webshell. It also supports guessing the timestamp/uniqid-derived uploaded filename around the server Date header to verify that the uploaded PHP is reachable and executes. No recognized exploit framework is used.

The repository contains one substantial Python 3 exploit program, CVE-2026-14894.py, plus a README and restrictive license. It is a standalone, multithreaded mass-exploitation utility rather than a Metasploit, Nuclei, or similar framework module. The program accepts a target list interactively or through NX_AUTO/NX_TARGETS environment settings, creates per-thread requests sessions with TLS certificate validation disabled, performs target reconnaissance, attempts both upload vectors, verifies payload execution, and writes successful URLs to Nx_shells.txt. The first vector targets CVE-2026-14894 in Super Forms. It obtains an unauthenticated nonce through super_create_nonce, then submits a base64 data-URI PHP payload through super_submit_form. It supports predictable path-traversal placement attempts at configurable depths and normal upload recovery through response parsing, WordPress media REST queries, and expected upload paths. The second vector targets CVE-2026-32475 in Elementor Pro through elementor_pro_forms_send_form. It crawls target pages to identify viable Elementor forms, auto-fills fields, and uses an empty first upload entry plus a PHP second entry to exploit a validation/processing-loop discrepancy. It then parses responses or sweeps expected Elementor upload names to recover the randomized payload location. The payload is an embedded PHP upload gateway/web shell called Nx.php. Successful execution is validated by requesting Nx.php?sig=1 and requiring an exact Nx-zD response, reducing false-positive reporting. The code is operational exploit tooling with a hardcoded payload and no evidence of external command-and-control behavior.