EIP-2026-114167

This exploit demonstrates an unprotected mail page vulnerability in WordPress Video Gallery 2.8, allowing unauthenticated users to send arbitrary emails by spoofing the Referer header. The PoC uses cURL to trigger the email function via admin-ajax.php.