EIP-2026-113585

The exploit leverages a deserialization vulnerability in BackWPUp 2.1.4 via the BackWPupJobTemp POST parameter, allowing remote code execution through crafted FTP resources. The PoC demonstrates how a malicious serialized payload can be executed via require_once after being deserialized.