EIP-2026-113872

This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in the Livesig WordPress plugin (version 0.4). The vulnerable code includes a user-controlled POST parameter 'wp-root' directly in an include statement, allowing arbitrary file inclusion.