EIP-2026-113768

This exploit demonstrates an arbitrary file upload vulnerability in the Foxypress WordPress plugin (versions 0.4.1.1 to 0.4.2.1). It uses cURL to upload a malicious PHP file (lo.php) to the vulnerable endpoint, achieving remote code execution (RCE).