Elementor Pro Forms Unauthenticated Arbitrary File Upload RCE

This 11-file repository is an operational Docker lab and Python proof of concept for a claimed CVE-2026-32475 Elementor Pro Forms validation flaw. Its primary exploit entry point, poc.py, sends two multipart parts for one optional file-upload form field: an empty first part causes validation() to return early, while a second shell.php part is still processed and moved by process_field(). This bypasses the extension blocklist and writes PHP under the Elementor forms uploads directory. The PoC then derives candidate filenames from PHP uniqid() format using the response Date header and concurrently probes them; upon finding its marker, it supplies a user-selected command through the shell's c query parameter to obtain RCE. The repository contains Bash automation to clone an Elementor Pro source mirror, derive a patched twin by replacing the vulnerable return with continue, start two WordPress 7.4 Apache/MariaDB stacks, and install a test page containing an optional upload field. setup_page.php creates that intentionally vulnerable form configuration. verify.sh independently checks, from inside the containers, whether a PHP shell was written and whether it executes on the vulnerable instance, while confirming the same request is blocked by the patched instance. The README, Docker Compose configuration, and captured transcript document the A/B lab design. It is not tied to an exploit framework; the shell payload and command are directly implemented in Python/PHP.

This two-file repository consists of an extensive README and a Python 3 PoC, cve-2026-32475-poc.py. It targets CVE-2026-32475 in Elementor Pro Forms through an unauthenticated multipart upload-validation bypass. The script first requests a user-supplied page and extracts post_id, form_id, queried_id, a file-field custom ID, and optionally text/email fields from HTML. It then POSTs to the WordPress admin AJAX handler with action=elementor_pro_forms_send_form and two entries for the same upload field: an empty first file followed by a PHP payload. This is intended to trigger early validation return for the empty entry while allowing the second entry to be stored without extension enforcement. The default payload is a marker-only PHP file; optional modes accept a custom local payload or generate an obfuscated PHP shell using the vapcom GET parameter for command execution. It classifies responses as vulnerable, patched/blocked, unknown, or error, supports target lists and CSV output, and includes a brute-force confirmation mode for the server-generated uniqid()-style filename in wp-content/uploads/elementor/forms/. No established exploit framework is used. The README documents usage, mitigation, compromise-hunting guidance, and states that Elementor Pro 4.2.2 fixes the issue.

This seven-file repository is an operational Python proof of concept for CVE-2026-32475, an unauthenticated arbitrary-file-upload vulnerability claimed to affect Elementor Pro Forms through version 4.2.1. The main entry point, script.py, discovers or accepts a public page containing an Elementor form, scrapes its post ID, form ID, upload-field identifier, and required fields, then submits a multipart request containing an empty file part followed by a PHP payload for the same upload field. This abuses the differing validation and processing behavior described in the README: validation returns early for the empty optional part while processing skips that part and moves the subsequent PHP file. The script estimates and brute-forces the uniqid()-based generated filename using response timing and parallel keep-alive probes, then executes a configurable command through the recovered webshell. It can optionally remove that shell and can process batch target lists and write JSON reports. banner.py supplies terminal branding. setup_form_page.php creates a deliberately vulnerable Elementor form page for testing. docker-compose.yml defines an isolated WordPress/MariaDB lab exposed at localhost:8090, while the README documents installation of a legally obtained vulnerable Elementor Pro package and exploit operation. No third-party exploitation framework is used; the payload is a hardcoded but command-configurable PHP webshell.

Repository contains a working exploit chain for CVE-2026-32475, targeting Elementor Pro <= 4.2.1 on WordPress. Although the repo includes a Nuclei template (CVE-2026-32475.yaml), it also ships a standalone Python exploit (el_rce_poc.py) that performs full exploitation rather than mere detection. The exploit abuses inconsistent handling of multiple uploaded files in Elementor Forms: an empty first file entry causes validation() to stop early, while process_field() continues and moves a second malicious .php file into the public uploads directory. The Python PoC first fetches a form page to scrape post_id, form_id, and optionally the upload field ID; then it submits a crafted multipart POST to /wp-admin/admin-ajax.php with two parts for the same upload field. The payload is a PHP webshell that prints a marker and executes shell commands from the X-CMD header. After upload, the script attempts to recover the generated filename by predicting PHP uniqid()-based names and probing /wp-content/uploads/elementor/forms/YYYY/MM/<candidate>.php concurrently until it finds the shell. Repository structure: README.md explains the vulnerability, attack flow, usage, and lab setup; analysis.md documents the uniqid() filename prediction logic; docker-compose.yml builds a local WordPress/MariaDB lab; setup_form_page.php creates a published Elementor form page with a file upload field for testing; CVE-2026-32475.yaml is a Nuclei template that validates the arbitrary upload condition by checking that the server response indicates failure without the expected file-type rejection. Overall, this is a real exploit repository with both detection/template content and an operational unauthenticated file-upload-to-RCE PoC.

This repository is a small standalone Python proof-of-concept exploit for CVE-2026-32475 affecting Elementor Pro <= 4.2.1 on WordPress. The repo contains only three files: a standard .gitignore, a README describing the vulnerability and usage, and the main exploit script pocel.py. The exploit is not part of a larger framework. The script automates exploitation of an unauthenticated arbitrary file upload in Elementor Pro forms. It first fetches a target page containing an Elementor form and uses regex to extract required identifiers such as post_id, form_id, and the upload field ID. It then submits a crafted multipart request to /wp-admin/admin-ajax.php using the Elementor action elementor_pro_forms_send_form. The multipart body contains two entries for the same upload field: an empty file part followed by a PHP payload. According to the README and code logic, this abuses inconsistent handling of empty upload entries during validation versus processing, allowing the PHP file to be moved into a web-accessible uploads directory. The payload is a simple PHP web shell that executes commands from the GET parameter c via system(). After upload, the script attempts to locate the generated PHP file by scanning a hardcoded local Laragon filesystem path (C:\laragon\www\wp\wp-content\uploads\elementor\forms). This means the PoC is fully operational in the author's local lab, but remote filename recovery is not automated in the script. Once a shell path is found, the script converts it to a URL under /wp-content/uploads/elementor/forms/ and either runs a single command or opens an interactive command loop. Overall capability: unauthenticated web exploitation leading to arbitrary PHP upload and RCE. Limitation: as written, remote exploitation is incomplete unless the operator can independently determine the generated filename or has local access to the uploads directory.