EIP-2026-113692

This exploit demonstrates an unauthenticated remote code execution vulnerability in the WordPress plugin 'Drag and Drop Multiple File Upload - Contact Form 7' version 1.3.3.2. It bypasses file type restrictions by appending '%' to the file type and filename, allowing the upload of a malicious PHP file.