CVE-2026-1056

This repository contains a functional exploit for CVE-2026-1056, an unauthenticated arbitrary file deletion vulnerability in Snow Monkey Forms WordPress plugin (versions <= 12.0.3). The exploit leverages path traversal via the 'formid' parameter to delete arbitrary files on the server.

This repository contains a functional exploit for CVE-2026-1056, an unauthenticated arbitrary file deletion vulnerability in Snow Monkey Forms for WordPress. The exploit leverages path traversal in the REST API endpoint to delete critical files, potentially leading to RCE.