EIP-2026-113737

This exploit demonstrates an arbitrary file upload vulnerability in the WordPress Fancy Gallery plugin (v1.2.4). It uses cURL to upload a malicious PHP file disguised as an image (lo.php.gif) to the vulnerable endpoint, enabling remote code execution.