xxconi/CVE-2026-4782

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that checks for CVE-2026-4782 (arbitrary file read) and related vulnerabilities in Avada Builder for WordPress. It attempts to read sensitive files via path traversal, checks for directory listing, and optionally tests for SSRF, but does not deliver a payload or achieve code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a Python script that exploits CVE-2026-4782 (arbitrary file read) in the Avada Builder WordPress plugin. It performs HTTP requests to a user-supplied target, attempts authentication, fetches a nonce, and sends crafted POST requests to read arbitrary files via path traversal. No backdoor, concealed payload, or operator-directed harm was observed. The script's behavior is consistent with a standard security testing tool.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwareAvada BuilderWordPress
Attack typespath traversalarbitrary file readinformation disclosureSSRF
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script sends crafted requests to detect and read arbitrary files via path traversal, but it only retrieves and displays file contents; it does not upload a shell, execute commands, or otherwise compromise the target beyond information disclosure. The primary operation is vulnerability scanning/validation, not exploitation.

CVE-2026-4782.py:122-196CVE-2026-4782.py:306-392

Requirements

  • WordPress site running Avada Builder <= 3.15.2CVE-2026-4782.py:4
  • Valid WordPress subscriber-level credentials (optional but recommended for authenticated exploitation)CVE-2026-4782.py:88-115
  • Nonce value from target site (auto-fetched or provided)CVE-2026-4782.py:49-81

Observed behavior

  • Fetches a nonce from the target WordPress site by scraping page source or REST APICVE-2026-4782.py:49-81
  • Optionally authenticates to WordPress using provided credentialsCVE-2026-4782.py:88-115
  • Sends POST requests to /wp-admin/admin-ajax.php with path traversal payloads in the 'attachment' field to attempt reading sensitive filesCVE-2026-4782.py:122-196
  • Checks for publicly listable fusion-forms upload directoriesCVE-2026-4782.py:234-268
  • Optionally tests for SSRF via form_to_url_action parameterCVE-2026-4782.py:275-299
  • Displays results in a table and optionally saves extracted file contents to a local fileCVE-2026-4782.py:370-392
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Requests
HTTP requests to user-supplied target URLThe script sends requests to the target specified via command-line arguments, which is expected for a PoC exploit.CVE-2026-4782.py:57CVE-2026-4782.py:162-163
File Write
Saves exploit results to a local file specified by --outputThe script writes retrieved file contents to a user-specified output file, which is a standard feature for saving scan results.CVE-2026-4782.py:370-378
Credential Handling
Accepts username and password for WordPress authenticationThe script uses provided credentials to authenticate to the target WordPress site, which is necessary for testing authenticated exploits.CVE-2026-4782.py:88-115
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied source code; no runtime behavior or network traffic was observed.
  • The script's effectiveness depends on the target's configuration and may not succeed in all cases.
  • Only the two text files (CVE-2026-4782.py and README.md) were provided; no other files exist in the repository snapshot.
  • The script imports third-party libraries (requests, rich, urllib3) which were not reviewed; their behavior is assumed to be benign.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1