🛠️ Usage Instructions

1. Prepare a text file containing your target WordPress sites (one per line):

2. Host your PHP shell online and have its direct URL ready.

Example: http://yourserver.com/shell.php

3. Run the script:

You will be prompted for:

• Targets file: Path to your list of targets (default: list.txt)
• Shell direct URL: The online, accessible shell you want to upload to targets
• Shell signature: A unique string in your shell for verification (e.g. Nxploited)
• Threads: Number of parallel threads (default: 10)

4. Output

• Exploit results are shown live on a professional Rich-powered interface.
• Successful targets and shell URLs are automatically saved to success_results.txt.

📝 Script Details

• Name: CVE-2026-1405.py
• Author: Nxploited
• Language: Python 3
• Libraries: requests, rich

How It Works

1. Sends a POST request to each target's vulnerable endpoint:
   • URL: /wp-json/slider-future/v1/upload-image/
   • Parameter: image_url pointing to your shell.
2. Parses the JSON response to extract the uploaded shell URL.
3. Visits the shell URL and searches for your signature string.
4. Displays status: success or failure for each target.

⚠️ Legal Disclaimer

This tool is for educational and authorized security testing purposes only.
Unauthorized use against sites you do not own or have explicit permission to test is illegal.

💡 Example Output