CVE-2026-4106: WordPress HT Mega Unauthenticated PII Disclosure Exploit

A robust, multi-threaded Proof of Concept (PoC) exploit for CVE-2026-4106, targeting the HT Mega - Absolute Addons for Elementor plugin for WordPress (versions < 3.0.7).

Vulnerability Overview

The HT Mega plugin registers several wp_ajax_nopriv_ hooks (e.g., wcsales_purchased_products, htmega_user_list_ajax) to fetch dynamic content for its widgets. However, it fails to implement proper authorization (current_user_can) or authentication (check_ajax_referer) checks.

This allows unauthenticated remote attackers to send crafted AJAX requests and extract highly sensitive Personally Identifiable Information (PII) directly from the WordPress database, including:

• Customer Names (First/Last)
• Billing Addresses (City, Country, State)
• Purchased Items & Prices
• User Lists & Contact Form Submissions

Features

• High-Speed Mass Scanner: Multi-threaded engine capable of scanning thousands of targets concurrently.
• WAF Bypass Mechanisms: Automated IP spoofing (X-Forwarded-For) and randomized User-Agent rotation to bypass standard Web Application Firewalls.
• Dual-Output Logging: Automatically extracts data into a machine-readable exploited_PII.json and a clean, grep-friendly exploited_summary.txt.
• Legacy SSL Support: Built-in SSL/TLS downgrade adapter to prevent handshake errors on older target servers (TLSV1_ALERT_INTERNAL_ERROR fix).
• False-Positive Filtering: Automatically ignores parked domains, suspended pages (e.g., Bluehost), and non-JSON HTML responses.

Installation

Clone the repository and install the required dependencies:

git clone https://github.com/ef3tr/CVE-2026-4106.git
cd CVE-2026-4106
pip install -r requirements.txt

Usage

You can run the exploit in two modes: Single Target or Mass Scan.

python exploit.py

Example Output (exploited_summary.txt):

[+] Target: https://example.com | Action: wcsales_purchased_products | Date: 2026-04-11 08:30:15
    -> Buyer: John Doe | Location: Berlin/Deutschland | Item: Premium Package | Price: €375 | URL: https://example.com/product/premium/
    -> Buyer: Jane Smith | Location: London/UK | Item: Basic Package | Price: €150 | URL: https://example.com/product/basic/

Disclaimer

This tool is provided for educational purposes and ethical security research only. The author is not responsible for any misuse or damage caused by this program. Only use this software on systems you own or have explicit permission to test.

References

WPScan

CVE-2026-4106