Share 
## https://sploitus.com/exploit?id=92EBD3D2-4256-54EE-9C2C-C4BA105BAC3E
# CVE-2026-10818
WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering


  
  
  
  


CVE-2026-10818

WPForms Pro โ‰ค 1.10.1.1 โ€” Unauthenticated Arbitrary File Write via Chunked Upload


  Proof-of-Concept Exploit
  Chunked Upload Init/Finalize Ordering โ†’ Predictable Path Exposure โ†’ Remote Code Execution


---

## Vulnerability Overview

| Field | Detail |
|---|---|
| **CVE ID** | CVE-2026-10818 |
| **Affected Plugin** | WPForms Pro (WordPress) |
| **Affected Versions** | All versions up to and including **1.10.1.1** |
| **Type** | Unauthenticated Arbitrary File Write |
| **CWE** | CWE-434: Unrestricted Upload of File with Dangerous Type |
| **CVSS 3.1** | **8.1 HIGH** โ€” `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| **Authentication** | None required |

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the `ajax_chunk_upload_finalize` function. This is due to the file type validation occurring **after** chunk metadata and file contents have already been written to disk, and the assembled file **not being deleted** upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

### Root Cause

```
wpforms_upload_chunk_init     โ†’  Metadata created BEFORE extension validation
wpforms_upload_chunk          โ†’  Chunk bytes written regardless of init result
wpforms_file_chunks_uploaded  โ†’  File assembled BEFORE type validation
                              โ†’  File persists on disk even when validation fails
```

The vulnerability chain exploits a critical ordering flaw in the chunked upload lifecycle:

1. **Init** creates metadata on disk before checking if the file extension is allowed
2. **Chunk** loads the metadata and writes raw bytes to a **predictable path** (`SHA1(UUID)-0.chunk`)
3. **Finalize** assembles the final file before validating its MIME type โ€” and does not clean up on failure
4. No nonce verification is enforced on any of the three AJAX endpoints
5. All three routes are registered for **unauthenticated visitors** (`wp_ajax_nopriv_*`)

---

## Features

- **Multi-target scanning** โ€” feed a list of targets, processed concurrently
- **Automatic form discovery** โ€” crawls pages, sitemaps, and 100+ common paths to locate WPForms upload fields
- **Version detection** โ€” reads `readme.txt` and HTML source to identify vulnerable WPForms versions
- **AJAX route validation** โ€” confirms `wpforms_upload_chunk_init` is externally reachable before proceeding
- **Dual upload strategy:**
  - **Finalized uploads** (init โ†’ chunk โ†’ finalize) with both safe and executable extensions
  - **Chunk-only uploads** (init โ†’ chunk, skip finalize) for deterministic file paths via `SHA1(UUID)`
- **Predictable path calculation** โ€” computes `SHA1(client-controlled UUID)` to derive the exact chunk URL without guessing
- **Directory listing diff** โ€” snapshots `/wpforms/tmp/` before and after exec uploads to identify newly written files
- **Hash leak extraction** โ€” scans all response bodies and headers for `.` filename patterns
- **Execution verification** โ€” confirms actual PHP execution by checking for a unique signature in the response body, filtering out static file serving and source code disclosure
- **PATH_INFO probing** โ€” attempts server-handler bypasses (`.chunk/x.php`, `/.php`) to trigger PHP execution on non-PHP extensions
- **Polyglot payloads** โ€” generates valid PNG images with embedded PHP after the IEND chunk
- **Professional output** โ€” real-time color-coded terminal display with per-target status tracking

---

## Requirements

```
Python >= 3.8
```

```bash
pip install requests urllib3 beautifulsoup4
```

> `beautifulsoup4` is optional but recommended for more reliable form field extraction.

---

## Usage

```bash
python CVE-2026-10818.py
```

You will be prompted for:

| Prompt | Description | Default |
|---|---|---|
| **Targets file** | Path to a text file containing one target per line | `list.txt` |
| **Threads** | Number of concurrent workers (1โ€“20) | `5` |

### Target File Format

```
https://example.com
http://target.org
subdomain.example.net
192.168.1.100
https://example.com/wordpress
```

One URL per line. Supports `http://`, `https://`, bare domains, IPs, and subdirectory installations.

---

## Output

### Terminal

```
  โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”“
  โ”ƒ                                                                โ”ƒ
  โ”ƒ      โ–ˆโ–ˆโ–„    โ–ˆโ–ˆ  โ–ˆโ–ˆ  โ–ˆโ–ˆ                                         โ”ƒ
  โ”ƒ      โ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆ                                          โ”ƒ
  โ”ƒ      โ–ˆโ–ˆ โ–ˆโ–ˆ  โ–ˆโ–ˆ    โ–ˆโ–ˆ                                           โ”ƒ
  โ”ƒ      โ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆ                                           โ”ƒ
  โ”ƒ      โ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ  โ–ˆโ–ˆ                                          โ”ƒ
  โ”ƒ                                                                โ”ƒ
  โ”ƒ      Nxploited  โ”  Khaled Alenazi  โ”  T.m @Kxploit             โ”ƒ
  โ”ฃโ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”ซ
  โ”ƒ      CVE-2026-10818     WPForms Pro โ‰ค 1.10.1.1                 โ”ƒ
  โ”ƒ      Chunked Upload โ†’ Predictable Path โ†’ RCE                  โ”ƒ
  โ”ƒ      Results โ”โ–ธ Nx_hit/                                        โ”ƒ
  โ”—โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”›
```

During the scan, each target progresses through labeled stages:

```
  02:14:52  โ—†  target.com                        VER  WPForms 1.9.3.1 vulnerable
  02:14:53  โ—†  target.com                       FORM  1 upload form(s) on /contact
  02:14:53  โ—†  target.com                     UPLOAD  6 safe + 5 exec payloads
  02:14:55  โ—†  target.com                        FIN  poly_png โ†’ a8f3...1b22.png URL returned
  02:14:57  โ—†  target.com                        DIR  listing enabled, 4 file(s) before exec upload
  02:14:59  โ—  target.com                       EXEC  shell_php โ†’ finalized on disk (hash unknown)
  02:15:01  โ—†  target.com                        DIR  1 NEW exec file(s) after upload!

  โ—  target.com  SHELL  dir-new:7c4f...e8a1.php  https://target.com/wp-content/uploads/wpforms/tmp/7c4f...e8a1.php
```

### Result Files

All results are saved to `Nx_hit/`:

| File | Content |
|---|---|
| `Nx_shell.txt` | Confirmed RCE โ€” URL, label, and response body preview |
| `Nx_vuln.txt` | Confirmed arbitrary file write without execution verification |

### Summary

```
  โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”“
  โ”ƒ  COMPLETE   150 targets processed                              โ”ƒ
  โ”ƒ                                                                โ”ƒ
  โ”ƒ  โ— 3 shell     โ— 12 vuln     โ—‹ 85 skip     โœ— 50 miss          โ”ƒ
  โ”ƒ                                                                โ”ƒ
  โ”ƒ  Results โ”โ–ธ Nx_hit/                                            โ”ƒ
  โ”—โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”›
```

| Symbol | Meaning |
|---|---|
| `โ—` shell | PHP execution confirmed on remote target |
| `โ—` vuln | File written to disk, execution not confirmed |
| `โ—‹` skip | Target unreachable, patched, or no upload form found |
| `โœ—` miss | Upload attempts failed |

---

## Scan Pipeline

```
Target
  โ”‚
  โ”œโ”€ Reachability (HTTPS โ†’ HTTP fallback)
  โ”œโ”€ WPForms Version Detection
  โ”œโ”€ Form Discovery (100+ page paths + sitemap crawl)
  โ”œโ”€ AJAX Route Validation
  โ”‚
  โ”œโ”€ Phase 1: Safe Uploads (png/jpg/pdf + finalize โ†’ URL)
  โ”‚     โ””โ”€ Shell verification on returned URLs
  โ”‚
  โ”œโ”€ Phase 2: Directory Snapshot (BEFORE)
  โ”‚
  โ”œโ”€ Phase 3: Exec Uploads (php/phtml/php5/phar/shtml + finalize)
  โ”‚     โ”œโ”€ Leaked filename extraction from response
  โ”‚     โ””โ”€ Hash pattern extraction from body + headers
  โ”‚
  โ”œโ”€ Phase 4: Directory Snapshot (AFTER) โ†’ Diff โ†’ New exec files
  โ”‚     โ””โ”€ Shell verification on each new file
  โ”‚
  โ”œโ”€ Phase 5: Hash Leak Verification
  โ”‚     โ””โ”€ Build URLs from leaked hashes โ†’ Shell check
  โ”‚
  โ”œโ”€ Phase 6: Chunk-Only Uploads (no finalize โ†’ predictable SHA1 path)
  โ”‚     โ””โ”€ Direct access + PATH_INFO bypass probing
  โ”‚
  โ””โ”€ Result Classification (shell / vuln / skip / miss)
```

---

## Disclaimer

This tool is provided **strictly for authorized security testing and educational research purposes**. Use it only on systems you own or have explicit written permission to test.

Unauthorized access to computer systems is illegal. The author assumes **no liability** for misuse, damage, or any legal consequences resulting from the use of this software.

By using this tool, you agree that you are solely responsible for your actions and that you will comply with all applicable laws and regulations.

---


  By: Nxploited
  Khaled Alenazi
  T.m @Kxploit