This is a republication. The original and always up to date version lives here: https://own2pwn. fr/articles/appsec/wp2shell-wordpress-rce (it also embeds a live, non-intrusive exposure checker).
Source: [Dev.to](https://dev.to/maxime_letheoricien_7fbbe/wp2shell-how-a-route-confusion-a-reachable-sqli-become-pre-auth-rce-in-wordpress-core-3mkf)