EIP-2026-114358

This exploit targets the Uncode WordPress theme (versions 1.3.0 and possibly 1.3.1) by leveraging an authenticated arbitrary file upload vulnerability to achieve remote code execution (RCE). It logs in as a low-privileged user, uploads a malicious ZIP file, and executes the payload.