EIP-2026-113476

This JavaScript exploit leverages an authenticated arbitrary file deletion vulnerability in WordPress 4.9.6 by abusing the `_wpnonce` token and the `editattachment` action to delete files outside the intended directory. It requires author-level privileges and executes via the browser's developer console.