EIP-2026-113606

The exploit details a Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerability in the WordPress Brandfolder plugin (version <=3.0). The vulnerability arises from unsanitized user input in the `wp_abspath` parameter, allowing attackers to include arbitrary local or remote files.