Take a look at the permission on the /root directory with ls -ld /root
, typically a non-root user will not have r-x permissions, which won't allow them to read the directory listing.
In your command sudo rm /root/wp-cron.php?doing_wp_cron=1.*
the filename expansion attempt happens in the shell running under your non-root user. That fails to expand to the individual filenames as you do not have permissions to read /root.
The shell then execs sudo\0rm\0/root/wp-cron.php?doing_wp_cron=1.*\0
. (Three separate, explicit arguments).
sudo
, after satisfying its conditions, execs rm\0/root/wp-cron.php?doing_wp_cron=1.*\0
.
rm
runs and attempts to unlink the literal path /root/wp-cron.php?doing_wp_cron=1.*
, failing as you've seen.
The solution to removing depends on your sudo permissions. If permitted, you may run a bash sub-process to do the file-name expansion as root:
sudo bash -c "rm /root/a*"
If not permitted, do the sudo rm with explicit filenames.