On: WordPress: Unauthenticated path traversal leading to conditional RCE

[graemep]

I think that is very likely to be common. It is an easy mistake to make if your code is in a directory the web server can read, which is common, and is usual with PHP.