EIP-2026-113812

This exploit demonstrates an arbitrary file upload vulnerability in the HTML5 AV Manager WordPress plugin (version 0.2.7), allowing an attacker to upload a malicious PHP file (lo.php) via a crafted POST request to the uploadify endpoint, resulting in remote code execution.