EIP-2026-114050

This exploit targets a pre-authentication RCE vulnerability in WordPress Plugin Simple File List <= 4.2.2. It uploads a malicious PHP file disguised as an image, renames it to a .php extension, and executes arbitrary commands via a password-protected backdoor.