## https://sploitus.com/exploit?id=0E9B93C2-B3B7-535F-A0EB-9D11FD996A55
# WordPress Multi-Exploit Tool - HFT404
```
╔══════════════════════════════════════════════════════════════╗
║ ║
║ ██╗ ██╗███████╗████████╗ ██████╗ ██╗ ██╗ ║
║ ██║ ██║██╔════╝╚══██╔══╝██╔════╝ ██║ ██║ ║
║ ███████║█████╗ ██║ ██║ ███╗███████║ ║
║ ██╔══██║██╔══╝ ██║ ██║ ██║██╔══██║ ║
║ ██║ ██║██║ ██║ ╚██████╔╝██║ ██║ ║
║ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ║
║ ║
║ WordPress Multi-Exploit Tool ║
║ 6 Exploits Integrated ║
╚══════════════════════════════════════════════════════════════╝
```
## 📋 Table of Contents
- [Overview](#overview)
- [Features](#features)
- [Exploits Included](#exploits-included)
- [Installation](#installation)
- [Usage](#usage)
- [Detection Methods](#detection-methods)
- [Verification System](#verification-system)
- [Results](#results)
- [Author](#author)
- [Disclaimer](#disclaimer)
## 🔍 Overview
**HFT404 WordPress Multi-Exploit Tool** is a comprehensive penetration testing tool designed for security researchers and ethical hackers. It integrates **6 WordPress exploits** targeting critical vulnerabilities with **strict verification** to eliminate false positives.
The tool features:
- 🔍 **Enhanced WordPress Detection** with scoring system
- 🛡️ **Strict Verification** - No false positives
- 💾 **Auto-Save Results** with verification status
- 📝 **Debug Logging** for troubleshooting
- 🚀 **Async Processing** for high performance
## ⚡ Features
```
┌─────────────────────────────────────────────────────────────┐
│ ✅ 6 WordPress Exploits Integrated │
│ ✅ Enhanced WordPress Detection (Score-based) │
│ ✅ Strict Verification (Login + Admin Check) │
│ ✅ Auto-Save Results in Results_cred/ │
│ ✅ Debug Logging System │
│ ✅ Multiple Encoding Support │
│ ✅ Error Handling (WinError 64, Timeouts, Retries) │
│ ✅ Concurrent Processing (Async) │
│ ✅ Color-Coded Output │
│ ✅ Multiple User-Agent Rotation │
└─────────────────────────────────────────────────────────────┘
```
## 🎯 Exploits Included
| # | CVE/Plugin | Type | Severity | Verification |
|---|-----------|------|----------|-------------|
| 1 | **CVE-2026-19598** - Pods | Privilege Escalation | 🔴 Critical | ✅ Login + Admin |
| 2 | **CVE-2026-19632** - TranslatePress | Account Takeover | 🔴 Critical | ✅ Reset Key |
| 3 | **CVE-2026-8206** - Kirki | Account Takeover | 🔴 Critical | ⚠️ Response Check |
| 4 | **Branda =3.8.0
```
## 🚀 Usage
### Basic Usage
```bash
# Single target
python3 multi_exploit.py -t https://target.com
# Single target with username
python3 multi_exploit.py -t https://target.com -u admin
# Scan multiple targets
python3 multi_exploit.py -f targets.txt
# With debug mode
python3 multi_exploit.py -t https://target.com --debug
```
### Advanced Usage
```bash
# With specific user IDs for Pods exploit
python3 multi_exploit.py -t https://target.com --id 1
# With multiple user IDs
python3 multi_exploit.py -t https://target.com --ids 1,2,3,4,5
# With attacker email for Kirki
python3 multi_exploit.py -t https://target.com -e attacker@email.com
# With custom threads
python3 multi_exploit.py -f targets.txt --threads 5
# With custom timeout
python3 multi_exploit.py -t https://target.com --timeout 45
# Quiet mode (only show successes)
python3 multi_exploit.py -f targets.txt --quiet
# Save results to custom file
python3 multi_exploit.py -f targets.txt -o results.txt
```
### All Options
```
usage: multi_exploit.py [-h] [-t TARGET] [-f FILE] [--id ID] [--ids IDS]
[-u USERNAME] [-e EMAIL] [-o OUTPUT] [--threads THREADS]
[--timeout TIMEOUT] [--quiet] [--skip-detection]
[--debug] [-v]
Options:
-t, --target Single target URL
-f, --file File with targets (one per line)
--id User ID for Pods exploit
--ids Comma-separated User IDs
-u, --username Target username (default: admin)
-e, --email Attacker email for Kirki
-o, --output Output file for results
--threads Concurrent threads (default: 3)
--timeout Request timeout (default: 30)
--quiet Only show successful results
--skip-detection Skip WordPress detection
--debug Enable debug logging
-v, --version Show version
```
## 🔍 Detection Methods
The tool uses **multiple detection methods** with a scoring system:
```python
# Detection Score System
Content Patterns: +3 points each
Meta Generator: +5 points
wp-json Link: +3 points
X-Pingback Header: +5 points
WordPress URLs: +2 points each
License.txt: +5 points
# Score Thresholds
Score >= 8: WordPress Confirmed
Score >= 5: WordPress Probable
Score
**Made with ❤️ by [HackfutSecRoot](https://github.com/HackfutSecRoot)**
**For Educational Purposes Only**