EIP-2026-114274

This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in the Wpeasystats WordPress plugin version 1.8. The vulnerable code includes a user-controlled parameter directly into a file path, allowing an attacker to include arbitrary remote files.