EIP-2026-113852

PRE-CVE

WordPress Plugin KenBurner Slider - 'admin-ajax.php' Arbitrary File Download

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-113852. PoCs published by MF0x.

AI-analyzed exploit summary The exploit demonstrates an arbitrary file download vulnerability in the KenBurner Slider WordPress plugin by manipulating the 'img' parameter in an AJAX request to retrieve sensitive files like 'wp-config.php'.

Description

WordPress Plugin KenBurner Slider - 'admin-ajax.php' Arbitrary File Download

Exploits (1)

exploitdb WORKING POC VERIFIED
by MF0x · textwebappsphp
https://www.exploit-db.com/exploits/39291

The exploit demonstrates an arbitrary file download vulnerability in the KenBurner Slider WordPress plugin by manipulating the 'img' parameter in an AJAX request to retrieve sensitive files like 'wp-config.php'.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: KenBurner Slider plugin for WordPress
No auth needed
Prerequisites: WordPress site with KenBurner Slider plugin installed
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026