EIP-2026-113652

PRE-CVE

WordPress Plugin Content Flow 3D 1.0.0 - Arbitrary File Upload

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-113652. PoCs published by g11tch.

AI-analyzed exploit summary This exploit targets a WordPress plugin (content-flow3d) to achieve arbitrary file upload via a vulnerable upload.php endpoint. It uses cURL to send a POST request with a malicious file (bazinga.php.jpg) to bypass restrictions.

Description

WordPress Plugin Content Flow 3D 1.0.0 - Arbitrary File Upload

Exploits (1)

exploitdb WORKING POC
by g11tch · phpwebappsphp
https://www.exploit-db.com/exploits/19036

This exploit targets a WordPress plugin (content-flow3d) to achieve arbitrary file upload via a vulnerable upload.php endpoint. It uses cURL to send a POST request with a malicious file (bazinga.php.jpg) to bypass restrictions.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: WordPress content-flow3d plugin version 1.0.0
No auth needed
Prerequisites: Target must have the vulnerable plugin installed and accessible · upload.php must be reachable
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026