xxconi/CVE-2026-9018

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-9018, an unauthenticated privilege escalation vulnerability in the Easy Elements for Elementor WordPress plugin. The script fetches a nonce from a public page, then sends a crafted AJAX request to overwrite the wp_capabilities user meta key, creating a new administrator account.

Backdoor review

No backdoor observed in reviewed code

The PoC script (CVE-2026-9018.py) and its README.md describe and implement a standard privilege escalation exploit for CVE-2026-9018. The script sends a crafted POST request to the target's AJAX endpoint to overwrite user meta and create an administrator account, then optionally verifies the login. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm beyond the stated exploit were observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareEasy Elements for Elementor – Addons & Website Templates
Attack typesprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively exploits the vulnerability by sending a crafted request to create an administrator account, which is the definition of exploit code. It does not merely detect or report the vulnerability.

CVE-2026-9018.py:74-82CVE-2026-9018.py:89-90

Requirements

  • WordPress user registration must be enabled on the target site.README.md:34
  • A page with the plugin's Login/Register widget must be publicly accessible and expose the easy_elements_nonce in the DOM.README.md:35-36

Observed behavior

  • Fetches the easy_elements_nonce from a specified page by matching regex patterns against the HTML.CVE-2026-9018.py:32-60
  • Sends a POST request to /wp-admin/admin-ajax.php with action=eel_register and custom_meta[wp_capabilities][administrator]=1 to create a new administrator user.CVE-2026-9018.py:63-107
  • Optionally verifies the new administrator account by logging into /wp-login.php and checking for /wp-admin/ in the redirect URL.CVE-2026-9018.py:110-137
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Sends POST to /wp-admin/admin-ajax.php with action=eel_register and custom_meta[wp_capabilities][administrator]=1This is the documented vulnerability exploitation step; it matches the CVE description and is the core of the PoC.CVE-2026-9018.py:74-82
Exploit Behavior
Fetches nonce from target page via regex on HTMLRequired prerequisite for the exploit; the nonce is publicly exposed by the vulnerable plugin.CVE-2026-9018.py:32-60
Exploit Behavior
Verifies admin access by logging into /wp-login.php and checking for /wp-admin/ redirect or Dashboard textPost-exploit verification step; confirms the newly created account has administrative privileges.CVE-2026-9018.py:110-137
Network Target
User-supplied target URL via -u/--url argumentThe script only interacts with the target specified by the user; no hardcoded external callbacks or data exfiltration endpoints.CVE-2026-9018.py:146-147
Review boundaries

What the analysis did not establish

  • Only the two supplied text files (CVE-2026-9018.py and README.md) were reviewed; no other repository files were inspected.
  • No dynamic or runtime analysis was performed; the review is based solely on static source code analysis.
  • Binary files were flagged as metadata-only and not analyzed, though none were reported in this artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1