murrez/cve-2026-0740Exploit script for CVE-2026-0740 targeting Ninja Forms file upload endpoints to upload a PHP shell, scanning a list of URLs and logging successful uploads.
An experimental/tool script that uses file upload endpoints for the Ninja Forms plugin on WordPress sites. It sends requests sequentially to targets in list.txt and writes successful uploads to the shell.txt file.
urllib3)pip install requests urllib3
| File | Description |
|---|
ninja.py | Main script. |
list.txt | Target URLs; one URL per line (http/https, optional port). Blank lines are ignored. |
shell.txt | (Output) Shell URLs are saved in append mode (a) on successful uploads. |
The constants at the beginning of the script must be adapted to the target plugin/form structure:
FORM_ID — form IDFIELD_ID — field IDSHELL_NAME — file name used on the serverSHELL_CONTENT — uploaded PHP contentSSL verification is disabled (verify=False); use only in test environments you trust.
Make sure list.txt is present in the project folder, then:
python ninja.py
Progress and error messages are written to standard output. If the process is interrupted by the user, it exits cleanly with KeyboardInterrupt.
list.txt does not exist, the script errors out and exits.admin-ajax.php (nf_fu_get_new_nonce).nf_fu_upload).shell.txt file.