A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.
The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_window_loader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. In environments where PEAR is installed with register_argc_argv enabled, this file inclusion can be leveraged to write and execute arbitrary PHP code, achieving full remote code execution.
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration.
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.
The Mane theme for WordPress contains a Local File Inclusion (LFI) vulnerability in all versions up to and including 1.7. This vulnerability allows unauthenticated attackers to include and execute arbitrary files on the server, potentially leading to remote code execution, bypass of access controls, and exposure of sensitive data.
The Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin is vulnerable to a Local File Inclusion (LFI) flaw in all versions up to and including 7.3.7.4. Authenticated attackers with administrator-level privileges can exploit this vulnerability via the em_options_save function to include and execute arbitrary PHP files on the server. Once a malicious file inclusion key is stored, it is executed on every admin_init event, including unauthenticated admin-ajax.php requests, enabling code execution without further authentication.
CVE-2026-32560 is a high severity vulnerability in LiquidThemes MagicAI for WordPress up to version 1.4. It involves improper control of filenames in include or require statements (CWE-98), enabling local file inclusion. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-66670 is a high severity vulnerability affecting Elated-Themes Måne versions up to and including 1.7. It involves an unauthenticated local file inclusion (LFI) issue, classified under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-66587 is a critical vulnerability in WP Cafe Pro versions prior to 3.0.15 that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw corresponds to CWE-98 and can lead to remote file inclusion attacks.
CVE-2026-28152 is a high-severity vulnerability in Select-Themes Tonda Core versions prior to 2.6. It involves an unauthenticated local file inclusion flaw, classified under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to potentially include arbitrary files on the server, leading to high impact on confidentiality, integrity, and availability.
CVE-2026-28151 is a high-severity vulnerability in Select-Themes Tonda versions prior to 2.6. It involves an unauthenticated local file inclusion flaw that allows improper control of filenames used in include or require statements in PHP. This vulnerability is categorized under CWE-98 and can lead to full confidentiality, integrity, and availability impact if exploited.
CVE-2026-66671 is a high-severity vulnerability in Elated-Themes Verdure Core versions up to and including 1.2. It is an unauthenticated Local File Inclusion (LFI) vulnerability caused by improper control of filenames used in include/require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to remote code execution or disclosure of sensitive information.
CVE-2026-66586 is a Local File Inclusion (LFI) vulnerability in Themewinter WP Cafe Pro versions prior to 3.0.15. This vulnerability involves improper control of filenames used in include or require statements in PHP, which can lead to remote file inclusion attacks. The vulnerability has a CVSS 3.1 score of 6.6, indicating a medium severity level with high impact on confidentiality, integrity, and availability. No specific affected versions are explicitly stated beyond being before 3.0.15. There is no vendor advisory or patch information provided in the input data.
CVE-2026-28150 is a high-severity vulnerability in the uxper Golo Framework versions prior to 1.7.5. It involves an unauthenticated Local File Inclusion (LFI) flaw, classified under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2025-15637 is a high severity vulnerability in Edge Themes Shuffle affecting versions up to 1.8. It is an unauthenticated Local File Inclusion (LFI) issue caused by improper control of filenames used in include/require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.
The Events Made Easy WordPress plugin (versions up to and including 3.2.5) contains a Local File Inclusion vulnerability in the eme_single_event_page_template function. Authenticated users with contributor-level access or higher can exploit this flaw to include and execute arbitrary PHP files on the server. This can lead to bypassing access controls, data exposure, or remote code execution if malicious PHP files are uploaded and included. The vulnerability triggers passively when any visitor loads the affected single-event page, requiring no further attacker interaction after payload submission.
CVE-2026-73387 is a high severity vulnerability in SmartDataSoft Resido versions up to 1.5. It involves an unauthenticated Local File Inclusion (LFI) due to improper control of filenames in include/require statements, classified under CWE-98. This flaw allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.