CVE-2026-6101: Wp Unsafe Zip Extraction Shallow Cleanupcve-2026-6101-wp-unsafe-zip-extraction-shallow-cleanup
A ZIP file is extracted using `unzip_file()`, followed by a shallow directory listing such as `glob()` or `scandir()` in a loop for validation or cleanup. This pattern is highly insecure because shallow loops do not recursively traverse subdirectories. Attackers can bypass file-type blacklists (e.g., `.php` checks) by placing malicious scripts within a neste
