EIP-2026-113876

The writeup details a Local File Inclusion (LFI) vulnerability in the Mail Masta WordPress plugin, where user-supplied input via the 'pl' parameter is directly included without validation. It identifies specific vulnerable files and lines of code, and provides a proof-of-concept example to exploit the vulnerability.