EIP-2026-113773

This exploit demonstrates an arbitrary file upload vulnerability in WordPress Front File Manager 0.1, allowing remote attackers to upload a malicious PHP file via a crafted cURL request to upload.php. The uploaded shell can then be accessed at a predictable path, leading to remote code execution.