Expected Output

If the exploitation is successful, the script will output:

How to Use the Exploit

Prerequisites

Ensure that a malicious shell.zip file exists in the same directory as the exploit script.

The shell.zip file should contain a PHP web shell (e.g., nxploit.php).

A valid WordPress account with Subscriber or higher privileges is required.

Execution Steps

1. Run the exploit script with the following command:

2. The script will check the target version and log in using the provided credentials.

3. If the target is vulnerable, the script will upload shell.zip and extract it.

4. If successful, the script will provide a URL to the uploaded shell.

Interacting with the Web Shell

Once the shell is successfully uploaded and extracted, you can interact with it by sending commands via a URL:

Mitigation Strategies

To mitigate this vulnerability, it is strongly recommended to:

1. Update the WPvivid plugin to the latest secure version.
2. Restrict user roles to prevent unauthorized file uploads.
3. Monitor server logs and file activity to detect suspicious uploads.
4. Disable direct script execution in the wp-content/uploads directory using .htaccess or server configurations.

Conclusion

This vulnerability presents a serious risk as it enables authenticated attackers to upload and execute malicious files on a WordPress server. Site administrators should take immediate action to secure their installations.

Disclaimer: This document is intended for ethical security research and educational purposes only. Exploiting vulnerabilities without permission is illegal and punishable under applicable laws. ( Nxploit | Khaled_alenazi )