EIP-2026-114092

This exploit demonstrates an arbitrary file upload vulnerability in WordPress SuperForms plugin (versions <= 4.9.X) by bypassing file extension validation via the 'accept_file_types' parameter. The attacker uploads a malicious file with a '.php4' extension, leading to remote code execution.