EIP-2026-107518

This exploit leverages an authentication bypass vulnerability in Guestbara <= 1.2, allowing an attacker to change the administrative password via a crafted POST request to the configuration.php endpoint. The HTML form submits directly to the vulnerable endpoint without requiring prior authentication.