EIP-2026-113506

This exploit demonstrates a CORS misconfiguration in WordPress 5.2.4, where the server improperly validates the Origin header and returns 'Access-Control-Allow-Credentials: true', allowing arbitrary websites to issue credentialed requests and bypass the same-origin policy.