This vulnerability (CVE-2026-57647) is classified as CWE-98, indicating improper control of filenames for include or require statements in PHP code. It affects bPlugins Panorama Viewer – 360 Degree Image + Video Viewer versions up to 1.6.1. The flaw allows a contributor-level user to perform local file inclusion, potentially leading to remote code execution or disclosure of sensitive files. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with contributor-level access can exploit this vulnerability to include arbitrary local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The high CVSS score indicates significant impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level user permissions and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the affected plugin in publicly accessible environments if possible.