Nxploited/CVE-2026-10818

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based exploit for CVE-2026-10818 that targets WPForms Pro <= 1.10.1.1. It performs an unauthenticated arbitrary file write via chunked uploads, then attempts to achieve remote code execution by uploading polyglot PNG/PHP files and verifying PHP execution through signature checks and PATH_INFO probing.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script (CVE-2026-10818.py) and its README.md documentation. The script implements a multi-target scanner for CVE-2026-10818, an arbitrary file write vulnerability in WPForms Pro. It uploads polyglot PNG/PHP payloads and a standalone PHP webshell to vulnerable targets, then verifies execution. All behavior is consistent with a legitimate proof-of-concept exploit for the stated CVE. No concealed, deceptive, or operator-directed harmful behavior beyond the normal exploit operation was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareWPForms ProWordPress
Attack typesArbitrary File UploadRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional exploit. It actively uploads malicious files to a target server and verifies code execution. The README explicitly describes it as a 'Proof-of-Concept Exploit' and the code contains logic to build and deploy a PHP webshell, then check for its successful execution.

README.md:16CVE-2026-10818.py:210-236CVE-2026-10818.py:389-409

Requirements

  • Target must be running a vulnerable version of WPForms Pro (<= 1.10.1.1).CVE-2026-10818.py:298-308
  • Target must have a WPForms upload form accessible on a discoverable page.CVE-2026-10818.py:344-386
  • The target's /wp-content/uploads/wpforms/tmp/ directory must be writable by the web server.CVE-2026-10818.py:44-45

Observed behavior

  • Discovers WPForms upload forms by crawling pages and sitemaps.CVE-2026-10818.py:311-341
  • Initiates a chunked upload via the 'wpforms_upload_chunk_init' AJAX action.CVE-2026-10818.py:485-495
  • Uploads a file chunk containing a polyglot PNG/PHP payload via the 'wpforms_upload_chunk' AJAX action.CVE-2026-10818.py:503-515
  • Finalizes the upload via 'wpforms_file_chunks_uploaded', which assembles the file on disk before validation.CVE-2026-10818.py:529-550
  • Verifies remote code execution by sending an HTTP GET request to the uploaded file and checking for a unique signature in the response.CVE-2026-10818.py:389-409
  • Attempts PATH_INFO bypasses (e.g., appending '/x.php' to the URL) to trigger PHP execution on non-PHP extensions.CVE-2026-10818.py:412-420
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Payload
PHP code embedded in polyglot PNG and standalone PHP files that echoes a signature, executes 'id' and 'whoami', and provides a file upload form.This is the expected payload for demonstrating remote code execution on a vulnerable target. It is not a backdoor; it is the exploit's intended effect.CVE-2026-10818.py:210-257
Author Contact
Khaled Alenazi, T.m @KxploitAuthor attribution in banner and README. This is standard for PoC code and does not indicate malicious intent.CVE-2026-10818.py:189README.md:224-226
Review boundaries

What the analysis did not establish

  • One file (likely a license or .gitignore) was omitted from the text evidence, but its absence does not affect the classification of the primary Python exploit script.
  • The evidence includes the complete source code of the exploit and its documentation, providing a full view of its intended behavior.
  • One file (unclassified, 1505 bytes) was present in the repository but not included in the text evidence. Its content and purpose are unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1