EIP-2026-113674

This exploit demonstrates an arbitrary file upload vulnerability in WordPress Custom Content Type Manager 0.9.5.13-pl, allowing attackers to upload malicious files disguised as images (jpg/png/gif) to achieve remote code execution (RCE). The exploit leverages a lack of proper file extension validation in the upload_form.php script.