CVE-2026-54845 is an unauthenticated local file inclusion vulnerability in PluginUs.Net MDTF affecting versions <=1.3.8. The flaw arises from improper control of filenames used in PHP include or require statements, enabling an attacker to include arbitrary local files. This can result in full system compromise, impacting confidentiality, integrity, and availability. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to perform local file inclusion, potentially leading to disclosure of sensitive information, code execution, and disruption of service. The impact affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected MDTF versions and monitor for suspicious activity related to file inclusion attempts.