Ensure you have the following before running the exploit:

✅ Dependencies

• Python 3.x
• requests module → Install with:
  root@kitploit:~

  pip install requests
  

• Target WordPress site with the vulnerable plugin installed.

✅ WordPress User Permissions

• Requires Subscriber+ access to exploit.

🚀 Exploit Usage

🔹 Running the Exploit

Example:

🔧 Advanced Usage

You can specify custom file names and order IDs:

🔹 Upload a specific file

🔹 Attach file to a different Order ID

📌 Script Behavior

1. Authenticates with WordPress using the provided credentials.
2. Verifies the file exists locally before uploading.
3. Executes the file upload exploit via the vulnerable AJAX endpoint.
4. Parses the server response and extracts the uploaded file URL.

✅ Expected Output

If successful, the script will return the uploaded file URL:

🔥 Mitigation & Fixes

• Upgrade the plugin to the latest patched version.
• Restrict file upload permissions to Admins only.
• Modify functions.php to block wp_ajax_wcoa_add_attachment from unauthorized users:
  root@kitploit:~

  if (!current_user_can('manage_woocommerce')) {
      wp_send_json_error(['message' => 'Unauthorized'], 403);
      exit;
  }
  

🛑 Legal Notice

This exploit is published for educational purposes and security research only.
Unauthorized use against systems without explicit permission is illegal and punishable under cybersecurity laws.
Use at your own risk.