EIP-2026-113878

This exploit demonstrates a Remote Code Execution (RCE) vulnerability in the WordPress MailChimp Subscribe Forms plugin (version 1.1). The vulnerability allows an attacker to inject PHP code into the 'sm_email' parameter, which is executed when an admin views the subscribers list.