EIP-2026-113860

This exploit demonstrates an arbitrary file upload vulnerability in the LB Mixed Slideshow WordPress plugin (v1.0). It uses cURL to upload a malicious PHP file disguised as an image (lo.php.gif) to the vulnerable endpoint, achieving remote code execution (RCE).