Jenderal92/CVE-2026-5118

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python 2 script that exploits CVE-2026-5118 by sending a crafted multipart POST request to /wp-admin/admin-ajax.php with role=administrator to create an administrator account on vulnerable Divi Form Builder installations.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python 2 exploit script (CVE-2026-5118.py) and its README.md documentation. The script performs exactly the privilege escalation attack described in CVE-2026-5118: it extracts a nonce, sends a crafted POST request with role=administrator to admin-ajax.php, and logs successful registrations. No concealed backdoor, unrelated payload, persistence mechanism, credential exfiltration to an external party, or deceptive behavior beyond the stated exploit was observed. The script's actions are limited to the documented vulnerability exploitation and local result logging.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareDivi Form BuilderWordPress
Attack typesprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a crafted HTTP request to create an administrator account on a remote target, which is the definition of an exploit. It does not merely detect the vulnerability; it exercises it to achieve privilege escalation.

CVE-2026-5118.py:68-107README.md:10-14

Requirements

  • Target must run a vulnerable version of Divi Form Builder (<= 5.1.2) with a registration form that exposes fb_nonce.CVE-2026-5118.py:32-55README.md:1
  • Target URL must be reachable and the registration endpoint must accept the crafted role parameter.CVE-2026-5118.py:68-107

Observed behavior

  • Normalizes a supplied URL and fetches the target homepage to extract a fb_nonce value using multiple regex patterns.CVE-2026-5118.py:24-55
  • Constructs a multipart/form-data POST request to /wp-admin/admin-ajax.php containing action=de_fb_ajax_submit_ajax_handler, the extracted nonce, role=administrator, and attacker-controlled username, password, and email.CVE-2026-5118.py:68-98
  • Sends the request and checks the response for success keywords (e.g., 'registration successful', 'user_id') to determine if an administrator account was created.CVE-2026-5118.py:100-107
  • Saves successful target admin URLs and credentials to results.txt and prints a success message.CVE-2026-5118.py:109-115
  • Uses multi-threading (default 20 threads) to iterate over a list of targets from a file, calling the exploit function on each.CVE-2026-5118.py:117-130CVE-2026-5118.py:147-182
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Creation
DEFAULT_USERNAME='Attacker', DEFAULT_PASSWORD='Attacker@123#+', DEFAULT_EMAIL='mail@admin.com'Hardcoded credentials used for the privilege escalation attack; consistent with the documented exploit behavior.CVE-2026-5118.py:16-18
Exploit Target
POST to /wp-admin/admin-ajax.php with action=de_fb_ajax_submit_ajax_handler and role=administratorThe core exploit mechanism matching the CVE description; no additional or unrelated actions are performed.CVE-2026-5118.py:68-107
Output File
results.txtSuccessful exploit results are saved locally in the format 'admin_url|username|password'; no network exfiltration is performed.CVE-2026-5118.py:109-115
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied text files; no runtime behavior or network traffic was observed.
  • The script is written for Python 2 and may not run in modern environments without modification, but this does not affect its classification as an exploit.
  • Only the two text files (CVE-2026-5118.py and README.md) were provided; no other repository files were inspected.
  • The script uses Python 2 and imports urllib2, threading, and Queue; no third-party dependencies or binary payloads are present.
  • The analysis is static and does not execute the code; dynamic behavior is not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1