Exploit Arsenal — Consolidated CVE PoC Collection

Summary

Exploit Arsenal is a growing offensive-security archive of standalone Python 3 standard-library proof-of-concept scripts covering WordPress plugin backdoor/LFI and n8n sandbox escape among other CVEs (CVSS up to 9.9).

Each entry ships a single .py file, README write-up, and screenshot of a successful run. No pip install — CLI flags with interactive prompt fallback.

OFFSITE.DARK indexes Exploit Arsenal from upstream GitHub only.

Key Findings

PoC Index (this card)

CVE-2026-0920 — LA-Studio Element Kit Admin Backdoor

Unauthenticated administrator account creation via lakit_bkrole parameter on the open AJAX registration handler. The lakit_ajax nonce is rendered on any page with the login/register widget.

Harvest lakit_ajax nonce from public page
        ↓
POST admin-ajax.php action=lakit_ajax + lakit_bkrole=1
        ↓
New account created with administrator role → full site takeover

• Affected: ≤ 1.5.6.3 — Fixed: 1.6.0
• PoC: python3 CVE-2026-0920.py --url http://TARGET

CVE-2026-0926 — Prodigy Commerce Local File Inclusion

Unauthenticated arbitrary local file read (→ RCE via included PHP) through the prodigy-render-my-account-widget AJAX action. parameters[template_name] is joined without stripping ../ traversal.

Harvest store-nonce from storefront page
        ↓
POST admin-ajax.php with template_name=../../../../etc/passwd
        ↓
Server includes arbitrary local file → wp-config.php / RCE chain

• Affected: ≤ 3.3.0 — Fixed: 3.3.1
• PoC: python3 CVE-2026-0926.py --url http://TARGET

CVE-2026-1470 — n8n Workflow Expression Sandbox Escape

Authenticated RCE via {{ }} workflow expressions. Static .constructor blocklist misses deprecated with statement — bare constructor inside with reaches Function constructor and require() for OS commands.

Login as workflow editor
        ↓
Create Webhook → Set workflow with sandbox-escape expression
        ↓
Activate + trigger webhook → arbitrary OS command on n8n host

• Affected: < 1.123.17 (and < 2.4.5 / < 2.5.1) — Fixed: 1.123.17 / 2.4.5 / 2.5.1
• PoC: python3 CVE-2026-1470.py --url http://TARGET:5678 -U user -P pass --command id

Mitigation (operators)

1. WordPress plugins — upgrade Element Kit to 1.6.0+ and Prodigy Commerce to 3.3.1+; audit administrator accounts.
2. n8n — upgrade to 1.123.17+ (or 2.4.5+ / 2.5.1+); restrict workflow edit permissions.
3. WAF rules on admin-ajax.php for lakit_bkrole, prodigy-render-my-account-widget with ../, and n8n /rest/workflows write methods.

Related Signals

• CVE-2026-54806 — WP Activity Log POI
• CVE-2026-49772 — Events Calendar SQLi
• CVE-2026-2002 — Forminator XSS
• LiteLLM proxy SQLi — same upstream repo also ships CVE-2026-42208 PoC
• Exploitarium collection

Sources

• Sploitus — exploit-arsenal
• GitHub — GODofExploit/exploit-arsenal
• NVD — CVE-2026-0920
• NVD — CVE-2026-0926
• NVD — CVE-2026-1470