CWE-98 vulnerabilities

The Noptin WordPress plugin up to version 4.4.3 contains a Local File Inclusion vulnerability via the 'noptin_fields[first_name]' parameter. This flaw allows unauthenticated attackers to include and execute arbitrary PHP files on the server. Exploitation requires an administrator to trigger the sending of a newsletter containing the malicious payload. The vulnerability can lead to code execution and potential data exposure.

CVE-2026-71550 is a critical remote file inclusion vulnerability in SuiteCRM prior to versions 7.15.2 and 8.10.2. It arises from the workflow controller using an attacker-controllable parameter in a require_once() call without proper validation, allowing authenticated users with the WorkFlow role to execute arbitrary PHP code on the server. This can lead to full server compromise, unauthorized access to CRM data and configuration secrets, and persistent unauthorized access. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.

The Bit Flows plugin for WordPress up to version 1.31.0 contains a Local File Inclusion vulnerability via the 'image' parameter used by the ImageHelper node. This flaw allows unauthenticated attackers to include and execute arbitrary PHP files on the server if certain webhook configurations are in place. Exploitation requires an administrator to have set up a webhook-triggered flow that uses the vulnerable parameter without additional security controls like bearer secrets or IP allowlists.

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.

The Mang Board WordPress plugin up to version 2.4.3 is vulnerable to a Local File Inclusion (LFI) vulnerability via the '<mode>_type' parameter. This allows unauthenticated attackers to include and execute arbitrary PHP files on the server, potentially leading to code execution and access control bypass. Exploitation requires no authentication and can be performed via a POST request to any page rendering the [mb_board] shortcode, which lacks nonce or capability checks. The vulnerability is classified as CWE-98 and carries a high CVSS score of 8.1.

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress versions up to and including 10.3.1 is vulnerable to Local File Inclusion (LFI) via the [lifterlms_checkout] shortcode. Authenticated users with Instructor-level access or higher can exploit this vulnerability by manipulating shortcode attributes to control the file path included by the plugin, potentially leading to arbitrary file inclusion and code execution.

ShopMagic – email automation for WordPress plugin versions up to 4.9.0 contains a Local File Inclusion vulnerability via the 'billing_address.first_name' parameter. This vulnerability allows unauthenticated attackers to include and execute arbitrary PHP files on the server. Exploitation is possible without authentication by submitting a specially crafted guest checkout using the default "New Order email with social media profile links" recipe, which processes the vulnerable placeholder. The flaw enables attackers to bypass access controls, access sensitive data, or execute arbitrary code if they can upload PHP files.

The BP Profile Search plugin for WordPress up to version 5.9 contains a Local File Inclusion (LFI) vulnerability via the 'ajax_template' parameter derived from a client-controlled cookie. This flaw allows unauthenticated attackers to include arbitrary PHP files on the server, potentially leading to remote code execution if malicious PHP files are present or can be uploaded. The vulnerability arises from insufficient validation of the template file path, lacking basename restrictions, whitelisting, or path traversal checks.

CVE-2026-66566 is a high-severity vulnerability in Elated-Themes Ambient versions up to 1.7. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-62115 is a high severity vulnerability in KuteShop versions up to and including 4.2.9. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements, classified under CWE-98. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62099 is a high-severity vulnerability in the Boutique product by kutethemes, affecting versions up to and including 2.3.3. It involves an unauthenticated local file inclusion (LFI) due to improper control of filenames in include/require statements in PHP, classified under CWE-98. This flaw allows an attacker to include files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-62096 is a high-severity vulnerability in kutethemes Biolife versions up to and including 3.2.3. It involves an unauthenticated Local File Inclusion (LFI) flaw, categorized under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-62094 is a high-severity vulnerability in kutethemes TechOne versions up to and including 3.0.3. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability allows an attacker to potentially include and execute arbitrary files on the server, impacting confidentiality, integrity, and availability.

CVE-2026-62092 is a high-severity vulnerability in kutethemes Armania versions up to 1.4.8 that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote code execution or full system compromise if exploited.

CVE-2026-62075 is a high-severity vulnerability in Mymoun Backhoe versions 2.0 and earlier that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote file inclusion attacks, potentially resulting in full system compromise.

CVE-2026-62074 is a high severity vulnerability in ThemeREX Ozeum versions up to and including 1.3.0. It involves an unauthenticated Local File Inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability can lead to remote file inclusion attacks, potentially allowing attackers to execute arbitrary code or access sensitive information.

CVE-2026-62070 is a high severity vulnerability in CKThemes Flipmart versions up to 2.8 that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote file inclusion attacks, potentially resulting in full system compromise.

CVE-2026-62069 is a high severity vulnerability in CocoBasic Fabius versions 1.0 and earlier. It involves an unauthenticated local file inclusion due to improper control of filenames in include/require statements, classified under CWE-98. This flaw allows an attacker to potentially include arbitrary files, leading to full confidentiality, integrity, and availability compromise.

CVE-2026-62068 is a high-severity vulnerability in CocoBasic Teoro versions 1.1 and earlier. It is an unauthenticated Local File Inclusion (LFI) vulnerability caused by improper control of filenames used in include or require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to remote code execution or data disclosure.

CVE-2026-62067 is a high-severity vulnerability in CocoBasic Kaven versions up to 1.2 that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote file inclusion attacks, potentially compromising confidentiality, integrity, and availability of the affected system.