EIP-2026-113538

The exploit demonstrates a local file read vulnerability in the WordPress plugin 'admin-word-count-column' version 2.2. The vulnerable PHP script 'download-csv.php' allows arbitrary file read via path traversal and null byte injection, which is effective on PHP versions 5.3.2 and below.