EIP-2026-111235

This exploit targets a Local File Include (LFI) vulnerability in phpwcms <= 1.2.6 via the 'wcs_user_lang' cookie, allowing remote code execution by injecting malicious PHP code into log files and including them through the vulnerable parameter.