EIP-2026-114292

PRE-CVE

WordPress Plugin Zingiri 2.2.3 - 'ajax_save_name.php' Remote Code Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-114292. PoCs published by EgiX.

AI-analyzed exploit summary This exploit targets a vulnerability in the Wordpress Zingiri Web Shop Plugin <= 2.2.3, allowing remote code execution by manipulating the $selectedDocuments array to write arbitrary PHP code into a file. The exploit establishes a shell by leveraging the vulnerable 'ajax_save_name.php' script.

Description

WordPress Plugin Zingiri 2.2.3 - 'ajax_save_name.php' Remote Code Execution

Exploits (1)

exploitdb WORKING POC VERIFIED
by EgiX · phpwebappsphp
https://www.exploit-db.com/exploits/18111

This exploit targets a vulnerability in the Wordpress Zingiri Web Shop Plugin <= 2.2.3, allowing remote code execution by manipulating the $selectedDocuments array to write arbitrary PHP code into a file. The exploit establishes a shell by leveraging the vulnerable 'ajax_save_name.php' script.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Wordpress Zingiri Web Shop Plugin <= 2.2.3
No auth needed
Prerequisites: Target must have the vulnerable plugin installed · Network access to the target WordPress site
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026