EIP-2026-113559

This exploit demonstrates a SQL injection vulnerability in the WordPress 'Allow PHP in Posts and Pages' plugin (version <= 2.0.0.RC1). The PoC uses a time-based blind SQL injection technique via the 'id' parameter in a POST request to alter.php, exploiting insufficient input sanitization.