CVE-2026-0926 is a critical Local File Inclusion vulnerability in the Prodigy Commerce WordPress plugin (versions up to 3.3.0). It arises from improper control of the filename used in an include/require statement, specifically via the 'parameters[template_name]' parameter. This allows unauthenticated attackers to include arbitrary files, potentially executing PHP code contained within them. The vulnerability can be exploited to bypass access controls, access sensitive data, or achieve remote code execution. The CVSS score of 9.8 reflects the high impact and ease of exploitation.

Successful exploitation can lead to remote code execution, unauthorized access to sensitive files, and bypass of access controls on affected servers running the vulnerable plugin. This poses a critical risk to the confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable parameter if possible, disable or remove the Prodigy Commerce plugin, or implement web application firewall (WAF) rules to block exploitation attempts targeting the 'parameters[template_name]' parameter. Monitor vendor channels for updates and apply official patches once released.