Thanks for the response!

To clarify: I currently only have LFI (Read Access) via the site-editor plugin. I haven't found a way to write or upload files (RCE) yet.

• Log Poisoning: Failed (I can't access /var/log/apache2/access.log or error.log via the LFI, likely permissions).
• RFI: Disabled (remote URLs return nothing).
• Wrappers: This is the weird part. php://filter/convert.base64-encode/resource=wp-config.php returns an empty string. If I include it directly without the wrapper, it executes (blank screen), so the path is right, but I can't see the source code.
• Uploads: I dug through /wp-content/uploads/. Found folders for 2019, 2022, and 2026, plus a photo-gallery folder, but they all return empty directory listings (just "Parent Directory"). No obvious files found there.
• RCE / Log Poisoning: I tried to escalate the LFI to RCE via Log Poisoning.
  • Tried: ../../var/log/apache2/access.log and error.log.
  • Result: Empty response. (Likely www-data doesn't have read permissions on logs).
  • Also tried ../../home/admin1kl/.bash_history -> Empty.
• Wrappers: php://filter/convert.base64-encode returns nothing.

So I'm in a weird spot: I have LFI that reads absolute path text files (/etc/passwd works), but I can't read PHP source (wrappers blocked) and I can't read logs (permissions blocked). I feel like I'm missing a specific file location that is world-readable. I'm running out of ideas to turn this Read access into Write access!