EIP-2026-113193

This exploit demonstrates a file upload vulnerability in WBCE CMS 1.6.1, allowing an authenticated admin to upload a malicious PHP file (upgrade.php) via the language installation feature, leading to remote command execution (RCE). The PoC includes a multipart form upload with a PHP payload executing the 'id' command.