Two things can be true: it's a real, exploitable CVE 10, and it's hard enough to construct that you need a good harness + verification process to keep your LLM from cheating. So, the exploit may not be easy to construct, but it doesn't actually require the artificial settings that the OP implied.
> What we demonstrated
> Pre-authentication RCE on WordPress, Drupal and Joomla
> What we demonstrated > Pre-authentication RCE on WordPress, Drupal and Joomla
[0] https://www.wiz.io/blog/php2shell-php-rce