i got wordpress phishing, it works good, also word press bruteforce by finding the users in wp-json. There are also ways to upload shells via xmlrpc is there is a misconfig.
I have the admin login for cattell mortgages and also have all the loan officer logins including the loan store.
I can offer proofs such as letting you login to an account
some these accounts are approved for up to 100k loans, most are around 20k
I just want to sell the logins for $200...