Can I upload a PHP reverse shell to a WordPress website if there is a directory listing vulnerability in the website? The condition is that I can see the entire file structure of /wp-includes in a WordPress website and I want to upload a PHP Reverse Shell in the directory /wp-includes so that I can get a reverse connection.

Is it possible?

  • 2
    There is a big difference between "read access" and "write access"...
    – schroeder
    Commented Jan 2, 2021 at 8:51

1 Answer 1


No you can't upload a reverse shell just because directory listing is enabled. You would need another vulnerability that allows you to upload arbitrary files to do that.

Not the answer you're looking for? Browse other questions tagged .