EIP-2026-113695

This exploit demonstrates a SQL injection vulnerability in WordPress Duplicator <= 0.5.14 via the 'duplicator_delid' parameter in the 'duplicator_package_delete' function. The PoC includes a crafted POST request to trigger a time-based SQL injection, confirming the vulnerability.