You don't need an RCE for that though. There's a lot of vulnerable plugins deployed everywhere.

Ok, but an RCE in WP Core still seems pretty dang valuable, especially if you want to hit non-commercial websites that are less likely to have as many plugins installed?