EIP-2026-113811

This exploit demonstrates an authenticated file upload vulnerability in the WordPress HS Brand Logo Slider plugin (v2.1), where client-side validation can be bypassed to upload arbitrary PHP files, leading to remote code execution (RCE). The PoC includes a sample HTTP request with a malicious PHP payload.