conditional rce

One ../ and the server hands over the wrong file

Unauthenticated WordPress path traversal lets an anonymous request select which file the server reads; execution follows where a code-executing sink exists.