EIP-2026-113816

This exploit leverages an unauthenticated option update vulnerability in WordPress Hybrid Composer <= 1.4.6 to enable user registration, set the default role to administrator, and create a new admin account. It demonstrates a complete admin takeover by manipulating WordPress settings via the `hc_ajax_save_option` action.