EIP-2026-113522

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in the WordPress Abtest plugin. The vulnerable code in 'abtest_admin.php' directly includes a file based on the 'action' parameter without proper sanitization, allowing arbitrary file inclusion.