This code is triggered whenever ANY user account accesses /wp-admin For it to work, we need the following 4 things:

1. The call must be an "ajax call" (wp_doing_ajax()) and the method must be POST. To do this, we simply call /wp-admin/admin-ajax.php
2. The "action" parameter must be "elementor_upload_and_install_pro" (see the function named Maybe_handle_ajax() in the same file)
3. The "_nonce" parameter must be retrieved after login by inspecting the /wp-admin page (this exploit does this in the DoLogin function)
4. The "fileToUpload" parameter must contain the ZIP archive we want to upload (see the function named upload_and_install_pro() in the same file)

The file we upload must have the following structure:

1. It must be a ZIP file. You can name it as you wish.
2. It must contain a folder named "elementor-pro"
3. This folder must contain a file named "elementor-pro.php"

This file will be YOUR payload (e.g., PHP Reverse Shell or anything else) WARNING: The fake plugin we upload will be activated by Elementor, which means every time we access any page, we will trigger our payload. For example, if it tries to connect to an offline server, that could lead to Denial of Service. To prevent this, I recommend using a variable to activate the payload. Something like this (access Anypage.php?activate=1 to proceed with the actual payload):