PG Play — So Simple

A WordPress box: enumerate users and brute-force a login with WPScan, exploit the Social Warfare plugin RCE (CVE-2019-9978) for a shell, loot an SSH key for stable access, then chain two sudo misconfigurations (service + a writable root script) to root.