EIP-2026-112623

This exploit targets TextPattern CMS 4.9.0-dev, leveraging authenticated plugin upload functionality to achieve remote command execution via a PHP webshell. It requires valid credentials and uploads a malicious plugin containing a command execution interface.