She couldn't access the live server via SSH – the client had locked her out after a "security incident" last year. But she had a trick from HackTricks: "WordPress plugin/theme file inclusion via parameter pollution."
/var/www/veridianhome/wp-content/themes/legacy-core/inc/backup-handler.php hacktricks wordpress
It downloaded. Jackpot.
A 200 OK, but the X-Powered-By header still read PHP/7.2.34 . Ancient. Vulnerable. She couldn't access the live server via SSH
It wasn't a backup. It was a web shell. The attacker had named it backup-handler.php and hid it inside a legitimate theme directory. hacktricks wordpress