EIP-2026-113513

This Metasploit module exploits an arbitrary file upload vulnerability in the '1 Flash Gallery' WordPress plugin (versions 1.30 to 1.5.7a). It uploads a malicious PHP file via a crafted POST request to the vulnerable upload.php endpoint, then triggers the payload by accessing the uploaded file.