EIP-2026-114137

This is a writeup detailing an arbitrary file upload vulnerability in WordPress Ultimate Product Catalogue Plugin v3.8.6, allowing authenticated users to upload malicious files leading to RCE. The vulnerability stems from insufficient file extension validation in the `UPCP_Handle_File_Upload` function.