EIP-2026-113990

This is a functional SQL injection exploit targeting WordPress PureHTML plugin <= 1.0.0. The PoC demonstrates a time-based blind SQLi via the 'id' parameter in a POST request to 'alter.php', exploiting improper use of $wpdb->prepare().