EIP-2026-114004

This exploit demonstrates an arbitrary file upload vulnerability in the WordPress Reflex Gallery plugin (v3.1.3). The vulnerability allows attackers to upload malicious files by manipulating the 'Year' and 'Month' GET parameters to control the upload path.