EIP-2026-114201

This exploit demonstrates an unrestricted file upload vulnerability in the Work the Flow File Upload WordPress plugin (v1.2.1). By manipulating the 'accept_file_types' parameter and filename extension in a POST request, an attacker can upload a malicious PHP file, leading to remote code execution.