EIP-2026-113809

The exploit demonstrates an arbitrary file download vulnerability in WordPress History Collection plugin <=1.1.1 due to improper filtering of the GET parameter 'var' in download.php. This allows attackers to download sensitive files like wp-config.php via directory traversal.