EIP-2026-113717

This exploit demonstrates an authenticated RCE vulnerability in WordPress Plugin Elementor versions 3.6.0-3.6.2 by uploading a malicious ZIP file containing a PHP payload. It requires valid credentials and leverages broken access control to execute arbitrary code.