EIP-2026-114048

The exploit demonstrates a local file inclusion (LFI) vulnerability in Simple Fields WordPress plugin versions 0.2 to 0.3.5, which can lead to remote code execution (RCE) by injecting PHP code into log files or leveraging allow_url_include. The vulnerability relies on null byte injection, which was fixed in PHP 5.3.4.