EIP-2026-113474

The exploit demonstrates a Remote Code Execution (RCE) vulnerability in WooCommerce v7.1.0 by injecting PHP code via the 'product-type' parameter, which is unsafely processed in the 'save' function. The PoC shows how arbitrary PHP code can be written to a file on the server.