CVE-2021-24155

This exploit leverages an authenticated file upload vulnerability in WordPress Plugin Backup Guard < 1.6.0, allowing high-privilege users to upload arbitrary PHP files, leading to remote code execution (RCE). The exploit includes a p0wny shell for post-exploitation interaction.

This is a functional Metasploit module that exploits an arbitrary file upload vulnerability in the WordPress Backup Guard plugin (versions < 1.6.0) to achieve authenticated remote code execution. The exploit uploads a malicious PHP file and triggers it via a crafted HTTP request.

This Metasploit module exploits an arbitrary file upload vulnerability in WordPress Backup Guard plugin versions < 1.6.0, allowing authenticated users to upload a malicious PHP file and execute it, resulting in remote code execution.