EIP-2026-114078

This exploit demonstrates a Remote Code Execution (RCE) vulnerability in the WordPress Plugin SP Project & Document Manager before version 4.22. It leverages a case-insensitive file extension check to upload a malicious PHP file (shell.pHP) and achieve code execution on the target system.