EIP-2026-114053

The exploit demonstrates an arbitrary file download vulnerability in the simple-image-manipulator WordPress plugin v1.0 due to lack of input sanitization and authentication in the download.php script. The PoC uses a crafted curl request to retrieve /etc/passwd.