EIP-2026-109703

This exploit demonstrates an authenticated RCE vulnerability in MyBB < 1.8.21 by leveraging a stored XSS to upload a malicious theme file, which then executes arbitrary PHP code when accessed by an admin.