EIP-2026-114246

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in WP Vault 0.8.6.6 due to improper escaping of the $_GET["wpv-image"] parameter. The PoC shows how an attacker can read arbitrary files by manipulating the parameter.