EIP-2026-113563

This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in the Annonces WordPress plugin (v1.2.0.0). The vulnerable code directly includes a user-supplied path via the 'abspath' parameter without validation, allowing arbitrary remote code execution.