EIP-2026-113508

This exploit demonstrates an arbitrary file deletion vulnerability in WordPress <= 4.9.6 by leveraging the `thumb` parameter in `post.php` to manipulate file paths, followed by a deletion request. It requires valid authentication and nonces.