CVE-2026-4280 is a Local File Inclusion vulnerability in the Breaking News WP plugin for WordPress (versions up to 1.3). The brnwp_ajax_form AJAX endpoint lacks authorization and CSRF protection, allowing authenticated users with low privileges to overwrite the brnwp_theme option with a path traversal payload. This option value is then directly used in an include() statement by the brnwp_show_breaking_news_wp() shortcode handler without sufficient path validation. The sanitize_text_field() function applied to the input does not remove directory traversal sequences (../), enabling attackers to include arbitrary files from the server filesystem.

Successful exploitation allows an authenticated user with Subscriber-level privileges or higher to include arbitrary files from the server via directory traversal, potentially exposing sensitive information such as system files. The vulnerability does not impact integrity or availability but has a high confidentiality impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the AJAX endpoint to trusted users and consider disabling the Breaking News WP plugin if not essential. Monitor for updates from the vendor or plugin author for an official fix addressing authorization, CSRF protection, and proper path validation.