Jenderal92/CVE-2026-4885

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 2 script that exploits CVE-2026-4885, an unauthenticated arbitrary file upload vulnerability in Piotnet Addons for Elementor Pro ≤ 7.1.70. It uploads a PHP web shell via the pafe_ajax_form_builder AJAX handler, leaks the shell URL, and verifies execution.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward mass-exploitation script for CVE-2026-4885. It uploads a PHP webshell to vulnerable WordPress sites using the documented vulnerability. The embedded shell provides server info and a file upload form, which is standard post-exploitation behavior. No concealed backdoor, credential theft, persistence mechanism, or unrelated payload was observed. The script's behavior is fully described in the README and implemented transparently in the Python code.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwarePiotnet Addons for Elementor ProWordPress
Attack typesarbitrary file uploadremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads a PHP web shell to a vulnerable target, leaks its URL, and verifies remote code execution. This is exploitation, not mere detection or scanning.

CVE-2026-4885.py:188-200CVE-2026-4885.py:271-284README.md:3-5

Requirements

  • Target must run Piotnet Addons for Elementor Pro ≤ 7.1.70 with a form containing a file upload field.CVE-2026-4885.py:1

Observed behavior

  • Detects plugin version via homepage asset regex or known CSS/JS paths.CVE-2026-4885.py:97-129
  • Crawls target pages to extract post_id, form_id, and file upload field name from Piotnet-specific HTML attributes.CVE-2026-4885.py:153-186
  • Uploads a PHP web shell (with GIF89a header) via multipart POST to wp-admin/admin-ajax.php?action=pafe_ajax_form_builder, trying multiple extensions (.phtml, .php3, .php4, .phps, .pht, .php2).CVE-2026-4885.py:188-200CVE-2026-4885.py:238-245
  • Leaks the uploaded shell URL by requesting pafe_export_database and parsing the CSV response.CVE-2026-4885.py:202-215
  • Verifies shell execution by fetching the leaked URL and checking for the 'Logic_Internet' string, then saves the URL to shells.txt.CVE-2026-4885.py:271-284
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Embedded Webshell
GIF89a; <?php echo 'Logic_Internet'.'<br>'.'Uname:'.php_uname().'<br>'.$cwd = getcwd(); ... ?>The script uploads this PHP code to the target server as part of the exploit. It is a simple webshell that displays system information and provides a file upload form. This is the intended payload for the CVE-2026-4885 exploit and is not hidden or deceptive.CVE-2026-4885.py:27-35
Output File
shells.txtSuccessful shell URLs are saved to this file. This is a standard feature for mass exploitation tools to collect results.CVE-2026-4885.py:16CVE-2026-4885.py:275-276
Network Behavior
Sends POST to wp-admin/admin-ajax.php with action=pafe_ajax_form_builder and GET to pafe_export_databaseThese requests exploit the vulnerable plugin endpoints to upload a file and leak its URL. This is the documented exploit path for CVE-2026-4885.CVE-2026-4885.py:195-200CVE-2026-4885.py:204
Review boundaries

What the analysis did not establish

  • Only the two text files (CVE-2026-4885.py and README.md) were reviewed. No binary files were present in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1