EIP-2026-113557

This exploit demonstrates a blind SQL injection vulnerability in WordPress All In One WP Security & Firewall 3.9.0. The PoC leverages improper sanitization of the 'orderby' parameter in multiple admin pages, allowing an attacker to inject malicious SQL queries.