EIP-2026-113687

This exploit targets a WordPress plugin vulnerability (Download From Files <= 1.48) to achieve arbitrary file upload. It leverages an insecure AJAX action to upload a malicious PHP file, bypassing extension restrictions.