Title: Edit the plugin can getshell
Last modified: September 20, 2018

---

# Edit the plugin can getshell

 *  [bug1312](https://wordpress.org/support/users/bug1312/)
 * (@bug1312)
 * [7 years, 11 months ago](https://wordpress.org/support/topic/edit-the-plugin-can-getshell/)
 * Can getshell at the editing plugin, is it a normal function or a bug?
 * request package
 *     ```
       POST /wordpress-4.9.4-zh_CN/wordpress/wp-admin/admin-ajax.php HTTP/1.1
       Host: localhost
       User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
       Accept: */*
       Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
       Accept-Encoding: gzip, deflate
       Referer: http://localhost/wordpress-4.9.4-zh_CN/wordpress/wp-admin/plugin-editor.php?plugin=hello.php&Submit=%E9%80%89%E6%8B%A9
       Content-Type: application/x-www-form-urlencoded; charset=UTF-8
       X-Requested-With: XMLHttpRequest
       Content-Length: 3016
       Cookie: tk_ai=jetpack%3AEt6v8W0UcexiRVzuoOEIi8FT; wordpress_ba71a3b9d80f9014a46a96984c955c9c=admin%7C1537601236%7CBmRBl75ZChw7bQrkWbaIm21m2tsg7PJV2ZvoK6F2GgL%7Cdad372e5b41eef62ae3dabfd5ba0fd4b23b21f55235627ed3d2f5e28adac75b0; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_ba71a3b9d80f9014a46a96984c955c9c=admin%7C1537601236%7CBmRBl75ZChw7bQrkWbaIm21m2tsg7PJV2ZvoK6F2GgL%7C0e6fd907a79c8c2d968fcb101fa238a0615f0463778f1ce3afaf4d16a8827f6e; wp-settings-time-1=1537433070; PHPSESSID=bu0flnjkkvu2viv5lsa6hkg487; ECS_ID=059c3e304c9f87c88874492b711e8ac8cfa9c805; ECS[visit_times]=4; Phpstorm-e635504f=b1a0f7d9-2b4e-42c7-8076-8778186262c9
       DNT: 1
       Connection: close
   
       nonce=56ee2bbe1a&_wp_http_referer=%2Fwordpress-4.9.4-zh_CN%2Fwordpress%2Fwp-admin%2Fplugin-editor.php%3Fplugin%3Dhello.php%26Submit%3D%25E9%2580%2589%25E6%258B%25A9&newcontent=%3C%3Fphp%0A%2F**%0A+*+%40package+Hello_Dolly%0A+*+%40version+1.6%0A+*%2F%0A%2F*%0APlugin+Name%3A+Hello+Dolly%0APlugin+URI%3A+http%3A%2F%2Fwordpress.org%2Fplugins%2Fhello-dolly%2F%0ADescription%3A+This+is+not+just+a+plugin%2C+it+symbolizes+the+hope+and+enthusiasm+of+an+entire+generation+summed+up+in+two+words+sung+most+famously+by+Louis+Armstrong%3A+Hello%2C+Dolly.+When+activated+you+will+randomly+see+a+lyric+from+%3Ccite%3EHello%2C+Dolly%3C%2Fcite%3E+in+the+upper+right+of+your+admin+screen+on+every+page.%0AAuthor%3A+Matt+Mullenweg%0AVersion%3A+1.6%0AAuthor+URI%3A+http%3A%2F%2Fma.tt%2F%0A*%2F%0Aphpinfo()%3B%0Afunction+hello_dolly_get_lyric()+%7B%0A%09%2F**+These+are+the+lyrics+to+Hello+Dolly+*%2F%0A%09%24lyrics+%3D+%22Hello%2C+Dolly%0AWell%2C+hello%2C+Dolly%0AIt's+so+nice+to+have+you+back+where+you+belong%0AYou're+lookin'+swell%2C+Dolly%0AI+can+tell%2C+Dolly%0AYou're+still+glowin'%2C+you're+still+crowin'%0AYou're+still+goin'+strong%0AWe+feel+the+room+swayin'%0AWhile+the+band's+playin'%0AOne+of+your+old+favourite+songs+from+way+back+when%0ASo%2C+take+her+wrap%2C+fellas%0AFind+her+an+empty+lap%2C+fellas%0ADolly'll+never+go+away+again%0AHello%2C+Dolly%0AWell%2C+hello%2C+Dolly%0AIt's+so+nice+to+have+you+back+where+you+belong%0AYou're+lookin'+swell%2C+Dolly%0AI+can+tell%2C+Dolly%0AYou're+still+glowin'%2C+you're+still+crowin'%0AYou're+still+goin'+strong%0AWe+feel+the+room+swayin'%0AWhile+the+band's+playin'%0AOne+of+your+old+favourite+songs+from+way+back+when%0AGolly%2C+gee%2C+fellas%0AFind+her+a+vacant+knee%2C+fellas%0ADolly'll+never+go+away%0ADolly'll+never+go+away%0ADolly'll+never+go+away+again%22%3B%0A%0A%09%2F%2F+Here+we+split+it+into+lines%0A%09%24lyrics+%3D+explode(+%22%5Cn%22%2C+%24lyrics+)%3B%0A%0A%09%2F%2F+And+then+randomly+choose+a+line%0A%09return+wptexturize(+%24lyrics%5B+mt_rand(+0%2C+count(+%24lyrics+)+-+1+)+%5D+)%3B%0A%7D%0A%0A%2F%2F+This+just+echoes+the+chosen+line%2C+we'll+position+it+later%0Afunction+hello_dolly()+%7B%0A%09%24chosen+%3D+hello_dolly_get_lyric()%3B%0A%09echo+%22%3Cp+id%3D'dolly'%3E%24chosen%3C%2Fp%3E%22%3B%0A%7D%0A%0A%2F%2F+Now+we+set+that+function+up+to+execute+when+the+admin_notices+action+is+called%0Aadd_action(+'admin_notices'%2C+'hello_dolly'+)%3B%0A%0A%2F%2F+We+need+some+CSS+to+position+the+paragraph%0Afunction+dolly_css()+%7B%0A%09%2F%2F+This+makes+sure+that+the+positioning+is+also+good+for+right-to-left+languages%0A%09%24x+%3D+is_rtl()+%3F+'left'+%3A+'right'%3B%0A%0A%09echo+%22%0A%09%3Cstyle+type%3D'text%2Fcss'%3E%0A%09%23dolly+%7B%0A%09%09float%3A+%24x%3B%0A%09%09padding-%24x%3A+15px%3B%0A%09%09padding-top%3A+5px%3B%09%09%0A%09%09margin%3A+0%3B%0A%09%09font-size%3A+11px%3B%0A%09%7D%0A%09%3C%2Fstyle%3E%0A%09%22%3B%0A%7D%0A%0Aadd_action(+'admin_head'%2C+'dolly_css'+)%3B%0A%0A%3F%3E%0A&action=edit-theme-plugin-file&file=hello.php&plugin=hello.php&docs-list=
       ```
   
 * insert PHP code: phpinfo();
 * visit url:[http://localhost/wordpress-4.9.4-zh_CN/wordpress/wp-content/plugins/hello.php](http://localhost/wordpress-4.9.4-zh_CN/wordpress/wp-content/plugins/hello.php)
   
   show phpinfo() details

Viewing 3 replies - 1 through 3 (of 3 total)

 *  [Santiago](https://wordpress.org/support/users/sjaure/)
 * (@sjaure)
 * [7 years, 11 months ago](https://wordpress.org/support/topic/edit-the-plugin-can-getshell/#post-10708852)
 * Hey [@bug1312](https://wordpress.org/support/users/bug1312/),
    Hope you are doing
   well, Could you please elaborate more on the issue? It is not clear.
 * Also, the link that you shared is pointing to localhost. It will work only for
   you.
 * Cheers
 *  Thread Starter [bug1312](https://wordpress.org/support/users/bug1312/)
 * (@bug1312)
 * [7 years, 11 months ago](https://wordpress.org/support/topic/edit-the-plugin-can-getshell/#post-10708949)
 * I am a test environment built locally.
 * [Bug details](https://github.com/fanyingjie2/issu/issues/2)
 *  [Santiago](https://wordpress.org/support/users/sjaure/)
 * (@sjaure)
 * [7 years, 11 months ago](https://wordpress.org/support/topic/edit-the-plugin-can-getshell/#post-10709023)
 * That’s the expected behaviour. You can edit plugin core files without restriction.
   
   Nevertheless, editing files through the dashboard is not recommended. You can
   easily introduce an error and lock yourself out of your dashboard.
 * I recommend editing the file in a code editor, keep a copy of the original and
   push it via a file administrator or FTP.
 * Hope this answer your question.
 * Have a great day 🙂

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Edit the plugin can getshell’ is closed to new replies.

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 3 replies
 * 2 participants
 * Last reply from: [Santiago](https://wordpress.org/support/users/sjaure/)
 * Last activity: [7 years, 11 months ago](https://wordpress.org/support/topic/edit-the-plugin-can-getshell/#post-10709023)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics