EIP-2026-113610

The exploit demonstrates a CSRF vulnerability in BuddyPress Activity Plus 1.5, allowing arbitrary file deletion via a crafted POST request to admin-ajax.php. The PoC includes a form that submits malicious input to delete files like wp-config.php by leveraging the bpfb_remove_temp_images action.