I would call this more of a privilege escalation attack than RCE.