CVE-2026-62066 is a high-severity vulnerability in CocoBasic Volos versions up to 1.2 that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote file inclusion attacks, potentially resulting in full system compromise.
CVE-2026-62065 is a high-severity vulnerability in CocoBasic Cardea versions up to 2.3. It is an unauthenticated Local File Inclusion (LFI) issue caused by improper control of filenames used in include/require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to full system compromise.
CVE-2026-62032 is a critical vulnerability in Designinvento's DirectoryPress plugin versions up to 3.6.27. It involves improper control of filenames used in include/require statements, leading to a PHP Local File Inclusion (LFI) flaw. This vulnerability allows an attacker to include unauthorized files on the server, potentially resulting in full system compromise.
CVE-2026-62020 is a high-severity vulnerability in Mikado-Themes TouchUp versions prior to 1.4. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements, classified under CWE-98. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.
CVE-2026-48194 is a high-severity vulnerability in kutethemes DukaMarket versions up to 1.3.0. It involves an unauthenticated Local File Inclusion (LFI) due to improper control of filenames in include/require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to remote code execution or full system compromise.
CVE-2026-48193 is a high severity vulnerability in kutethemes Uminex versions up to and including 1.0.9. It is an unauthenticated Local File Inclusion (LFI) vulnerability caused by improper control of filenames used in include or require statements in PHP. This flaw could allow an attacker to include and execute arbitrary local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-42777 is a high-severity vulnerability in Edge-Themes Aalto versions 1.8 and earlier that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote file inclusion attacks, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-42724 is a high-severity vulnerability in AncoraThemes CleanSkin versions up to and including 1.5.0. It involves an unauthenticated Local File Inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP code. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.
CVE-2026-42704 is a high-severity vulnerability in the Kids Care theme by axiomthemes, affecting versions up to and including 3.2.4. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability could allow an attacker to include arbitrary files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress contains a Local File Inclusion vulnerability in all versions up to and including 2.8.187. This vulnerability is exploitable via the 'design_type' parameter and allows unauthenticated attackers to include and execute arbitrary PHP files on the server. The exploit requires a nonce value that is publicly accessible on all frontend pages, meaning no authentication or user interaction is needed. Successful exploitation can lead to bypassing access controls, disclosure of sensitive data, or remote code execution.
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
The SiteOrigin Widgets Bundle WordPress plugin up to version 1.73.2 contains a Local File Inclusion vulnerability via the 'theme' parameter. Authenticated users with contributor-level access or higher can exploit this flaw to include and execute arbitrary PHP files on the server. This allows execution of arbitrary PHP code, potentially bypassing access controls and exposing sensitive data. Exploitation involves sending a crafted widgetData payload to a specific REST endpoint, bypassing field validation.
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Notably, exploitation does not require authentication in practice, as the locale filter is installed unconditionally on every request during plugins_loaded and the callback performs no nonce or capability check before returning the raw GET parameter value.
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication.
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PHP where a local file containing PHP code can be reached. Exploitation requires the plugin's Lightspeed subsystem to be enabled, which is not the default.
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.