EIP-2026-113530

This exploit demonstrates an arbitrary file download vulnerability in WordPress Plugin ad manager wd v1.0.11. The vulnerability arises from improper handling of the 'path' parameter in the export_csv functionality, allowing attackers to download sensitive files like wp-config.php.