EIP-2026-114189

The exploit demonstrates a CSRF vulnerability in WordPress WHIZZ plugin versions <1.1.1, allowing attackers to delete users or change plugin status via crafted image tags. The PoC includes direct URLs that trigger these actions when loaded by an authenticated admin.