EIP-2026-114001

The exploit demonstrates an arbitrary file download vulnerability in the recent-backups WordPress plugin due to lack of authentication and input sanitization in download-file.php. It allows unauthenticated attackers to download sensitive system files via a crafted GET request.