Yii 2 versions 2.0.54 and earlier contain a vulnerability in the core view rendering method View::renderPhpFile() that allows local file inclusion due to improper input validation. This occurs because the function uses extract($_params_, EXTR_OVERWRITE) before including the view file, enabling an attacker to overwrite the internal variable specifying the file to include via a specially crafted _file_ key in the parameters array. This flaw can lead to remote code execution if an attacker can write PHP files through another vulnerability, as well as information disclosure. The issue is fixed in version 2.0.55.
The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.1.0 via the 'template' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter of the 'get_content' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.
Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user provided .zip as PHP. Successful exploitation requires Teacher or higher privileges. Exploitation could result in compromise of the underlying web server.
The Livemesh Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.0. This is due to insufficient sanitization of the template name parameter in the `lae_get_template_part()` function, which uses an inadequate `str_replace()` approach that can be bypassed using recursive directory traversal patterns. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the attacker to include and execute local files via the widget's template parameter granted they can trick an administrator into performing an action or install Elementor.
CVE-2026-33513 is a high-severity path traversal vulnerability in WWBN AVideo versions up to 26.0. An unauthenticated API endpoint improperly concatenates user input into an include path without validation, allowing attackers to traverse directories and include arbitrary PHP files within the web root. This can lead to file disclosure and limited code execution of existing PHP files. If an attacker can upload or control PHP files elsewhere in the directory tree, this vulnerability can escalate to full remote code execution (RCE). No patches are currently available, and exploitation requires no authentication or user interaction. The vulnerability poses significant risk to organizations using AVideo for video hosting and streaming, especially those with publicly accessible instances. Immediate mitigations include restricting access to the vulnerable API, implementing input validation, and monitoring for suspicious file access patterns.
CVE-2026-33130 is a medium-severity vulnerability in Uptime Kuma versions 1.23.0 through 2.2.0 that allows attackers with limited privileges to read arbitrary files on the server. The issue arises from improper control of filename inclusion in the LiquidJS template engine, specifically in the require.resolve() fallback mechanism, which lacks containment checks for unquoted absolute paths. This flaw enables remote file inclusion (RFI) attacks, potentially exposing sensitive server files such as /etc/passwd. The vulnerability does not require user interaction but does require some level of privileges (PR:L). It was fixed in version 2.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Melania allows PHP Local File Inclusion.This issue affects Melania: from n/a through 2.5.0.
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.3 via the 'template' parameter in gallery shortcodes. This makes it possible for authenticated attackers, with Author-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVE-2026-27894 is a high-severity vulnerability in LDAP Account Manager (LAM) versions prior to 9.5 that allows authenticated users to perform local file inclusion via the PDF export functionality. This flaw stems from improper control of filenames used in PHP include/require statements, enabling attackers to execute arbitrary PHP code on the server. Exploitation requires user login but no additional user interaction. The vulnerability can be combined with another (GHSA-88hf-2cjm-m9g8) to escalate impact. The issue is fixed in LAM version 9.5. As a workaround, administrators can restrict write permissions on the configuration directory and remove PDF profile files to disable PDF exports. The CVSS score is 8.8, reflecting high impact on confidentiality, integrity, and availability with network attack vector and low complexity.
IFTOP developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server.
Prodigy Commerce WordPress plugin versions up to 3.3.0 contain a critical Local File Inclusion vulnerability via the 'parameters[template_name]' parameter. This flaw allows unauthenticated attackers to include and read arbitrary files or execute arbitrary PHP code on the server. Exploitation can lead to bypassing access controls, disclosure of sensitive information, or full remote code execution. The vulnerability is identified as CWE-98 and has a CVSS v3.1 score of 9.8, indicating critical severity. No official patch or remediation information is currently available.
The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the `flexipsg_carousel` shortcode. This is due to the `theme` parameter being directly concatenated into a file path without proper sanitization or validation, allowing directory traversal. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server via the `theme` parameter granted they can create posts with shortcodes.
The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Talemy Spirit Framework allows PHP Local File Inclusion.This issue affects Spirit Framework: from n/a through 1.2.13.
The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute of the 'get_template' shortcode. This is due to insufficient path validation on user-supplied input passed to the get_template_part() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.
The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in brandexponents Oshine allows PHP Local File Inclusion.
This issue affects Oshine: from n/a before 7.3.0.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mojoomla WPCHURCH allows PHP Local File Inclusion.This issue affects WPCHURCH: from n/a through 2.7.0.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.1.