EIP-2026-109637

This exploit demonstrates an arbitrary file upload vulnerability in Multiple File Attachments Mail Form Pro v2, allowing attackers to upload a webshell due to insecure file permissions (777). The PoC highlights the vulnerable `upload.php` code and provides a simple mitigation.