shinthink/CVE-2026-8713

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script (cve_2026_8713.py) that implements both a vulnerability scanner and an active exploit for CVE-2026-8713. In its default 'detection' mode, it identifies vulnerable Avada Builder installations. When the `--exploit` flag is used, it sends crafted HTTP requests to delete arbitrary files (e.g., wp-config.php) via path traversal, leading to remote code execution. The README provides usage instructions for both modes.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python PoC exploit for CVE-2026-8713 (Avada Builder arbitrary file deletion). The code performs exactly the documented vulnerability exploitation: detecting Avada installations, finding form IDs, and sending path-traversal payloads to delete files. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the stated exploit was observed. The exploit behavior is consistent with the README description and the CVE advisory.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareAvada (Fusion) BuilderWordPress
Attack typespath traversalarbitrary file deletionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact, cve_2026_8713.py, contains code that, when invoked with the --exploit flag, actively sends path traversal payloads to delete arbitrary files on a target server. This constitutes an exploit. The script also includes a non-destructive detection mode, but the presence of the destructive capability makes the overall artifact an exploit.

cve_2026_8713.py:193-268cve_2026_8713.py:546

Requirements

  • Target must have a vulnerable version of Avada (Fusion) Builder plugin (<= 3.15.3) installed.cve_2026_8713.py:6-8
  • Target must have a published Avada form configured to save entries to the database.cve_2026_8713.py:149-189
  • The WordPress admin-ajax.php endpoint must be reachable (POST or GET).cve_2026_8713.py:220-234

Observed behavior

  • Detects Avada/Fusion Builder installations by checking for known file paths and markers.cve_2026_8713.py:106-147
  • Finds published Avada form IDs via REST API, homepage scraping, or brute-force.cve_2026_8713.py:149-189
  • In exploit mode, sends a crafted POST or GET request to admin-ajax.php with a path traversal payload (e.g., ../../wp-config.php) and parameters to trigger immediate file deletion.cve_2026_8713.py:193-268
  • Verifies file deletion by checking HTTP status codes of the targeted file or checking if WordPress enters setup mode.cve_2026_8713.py:241-296
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script sends HTTP requests to target WordPress sites to detect Avada, find form IDs, and submit path-traversal payloads to delete files (e.g., wp-config.php).This is the documented exploit behavior for CVE-2026-8713. No additional hidden actions were identified.cve_2026_8713.py:193-268cve_2026_8713.py:379-450
Network Communication
The script communicates with target hosts over HTTP/HTTPS to perform detection and exploitation.Expected for a network-based exploit PoC. No communication to attacker-controlled infrastructure was found.cve_2026_8713.py:98-102cve_2026_8713.py:106-189
File Deletion
The script deletes files on the target server via path traversal in the maybe_delete_files function.This is the core vulnerability being exploited. The script only deletes files on the target specified by the user.cve_2026_8713.py:193-268README.md:35-41
Review boundaries

What the analysis did not establish

  • One file (total 4) was omitted from the packet due to being unclassified (70 bytes). Its content is unknown but unlikely to change the classification given the complete exploit code is present.
  • The evidence packet reports complete_artifact_coverage as false, indicating not all repository files were included, but all selected text files are complete.
  • One file (70 bytes, unclassified) was not provided as text and was not analyzed. Its small size makes a backdoor unlikely, but its content is unknown.
  • The review is limited to the supplied text evidence; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1