EIP-2026-114199

This exploit demonstrates a CSRF vulnerability in WordPress Download Manager plugin (version 2.9.60) that allows an attacker to install arbitrary plugins via the `wpdm-install-addon` AJAX action. The PoC includes a crafted HTML form that submits a malicious plugin URL, leading to remote code execution if the plugin contains malicious code.