nxploited/cve-2026-10818WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
Proof-of-Concept Exploit
Chunked Upload Init/Finalize Ordering → Predictable Path Exposure → Remote Code Execution
| Field | Detail |
|---|
| CVE ID | CVE-2026-10818 |
| Affected Plugin | WPForms Pro (WordPress) |
| Affected Versions | All versions up to and including 1.10.1.1 |
| Type | Unauthenticated Arbitrary File Write |
| CWE | CWE-434: Unrestricted Upload of File with Dangerous Type |
| CVSS 3.1 | 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Authentication | None required |
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
wpforms_upload_chunk_init → Metadata created BEFORE extension validation
wpforms_upload_chunk → Chunk bytes written regardless of init result
wpforms_file_chunks_uploaded → File assembled BEFORE type validation
→ File persists on disk even when validation fails
The vulnerability chain exploits a critical ordering flaw in the chunked upload lifecycle:
SHA1(UUID)-0.chunk)wp_ajax_nopriv_*)readme.txt and HTML source to identify vulnerable WPForms versionswpforms_upload_chunk_init is externally reachable before proceedingSHA1(UUID)SHA1(client-controlled UUID) to derive the exact chunk URL without guessing/wpforms/tmp/ before and after exec uploads to identify newly written files<32hex>.<ext> filename patterns.chunk/x.php, /.php) to trigger PHP execution on non-PHP extensionsPython >= 3.8
pip install requests urllib3 beautifulsoup4
beautifulsoup4is optional but recommended for more reliable form field extraction.
python CVE-2026-10818.py
You will be prompted for:
| Prompt | Description | Default |
|---|---|---|
| Targets file | Path to a text file containing one target per line | list.txt |
| Threads | Number of concurrent workers (1–20) | 5 |
https://example.com
http://target.org
subdomain.example.net
192.168.1.100
https://example.com/wordpress
One URL per line. Supports http://, https://, bare domains, IPs, and subdirectory installations.
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ ┃
┃ ██▄ ██ ██ ██ ┃
┃ ████ ██ ████ ┃
┃ ██ ██ ██ ██ ┃
┃ ██ ████ ████ ┃
┃ ██ ███ ██ ██ ┃
┃ ┃
┃ Nxploited ━ Khaled Alenazi ━ T.m @Kxploit ┃
┣━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ CVE-2026-10818 WPForms Pro ≤ 1.10.1.1 ┃
┃ Chunked Upload → Predictable Path → RCE ┃
┃ Results ━▸ Nx_hit/ ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
During the scan, each target progresses through labeled stages:
02:14:52 ◆ target.com VER WPForms 1.9.3.1 vulnerable
02:14:53 ◆ target.com FORM 1 upload form(s) on /contact
02:14:53 ◆ target.com UPLOAD 6 safe + 5 exec payloads
02:14:55 ◆ target.com FIN poly_png → a8f3...1b22.png URL returned
02:14:57 ◆ target.com DIR listing enabled, 4 file(s) before exec upload
02:14:59 ◐ target.com EXEC shell_php → finalized on disk (hash unknown)
02:15:01 ◆ target.com DIR 1 NEW exec file(s) after upload!
● target.com SHELL dir-new:7c4f...e8a1.php https://target.com/wp-content/uploads/wpforms/tmp/7c4f...e8a1.php
All results are saved to Nx_hit/:
| File | Content |
|---|---|
Nx_shell.txt | Confirmed RCE — URL, label, and response body preview |
Nx_vuln.txt | Confirmed arbitrary file write without execution verification |
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ COMPLETE 150 targets processed ┃
┃ ┃
┃ ● 3 shell ◐ 12 vuln ○ 85 skip ✗ 50 miss ┃
┃ ┃
┃ Results ━▸ Nx_hit/ ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
| Symbol | Meaning |
|---|---|
● shell | PHP execution confirmed on remote target |
◐ vuln | File written to disk, execution not confirmed |
○ skip | Target unreachable, patched, or no upload form found |
✗ miss | Upload attempts failed |
Target
│
├─ Reachability (HTTPS → HTTP fallback)
├─ WPForms Version Detection
├─ Form Discovery (100+ page paths + sitemap crawl)
├─ AJAX Route Validation
│
├─ Phase 1: Safe Uploads (png/jpg/pdf + finalize → URL)
│ └─ Shell verification on returned URLs
│
├─ Phase 2: Directory Snapshot (BEFORE)
│
├─ Phase 3: Exec Uploads (php/phtml/php5/phar/shtml + finalize)
│ ├─ Leaked filename extraction from response
│ └─ Hash pattern extraction from body + headers
│
├─ Phase 4: Directory Snapshot (AFTER) → Diff → New exec files
│ └─ Shell verification on each new file
│
├─ Phase 5: Hash Leak Verification
│ └─ Build URLs from leaked hashes → Shell check
│
├─ Phase 6: Chunk-Only Uploads (no finalize → predictable SHA1 path)
│ └─ Direct access + PATH_INFO bypass probing
│
└─ Result Classification (shell / vuln / skip / miss)
This tool is provided strictly for authorized security testing and educational research purposes. Use it only on systems you own or have explicit written permission to test.
Unauthorized access to computer systems is illegal. The author assumes no liability for misuse, damage, or any legal consequences resulting from the use of this software.
By using this tool, you agree that you are solely responsible for your actions and that you will comply with all applicable laws and regulations.
By: Nxploited
Khaled Alenazi
T.m @Kxploit