CVE-2026-23978 is a flaw in the Softwebmedia Gyan Elements WordPress plugin that improperly controls filenames used in PHP include/require statements, allowing an attacker to perform local file inclusion. The vulnerability is categorized as CWE-98. By exploiting this weakness, an attacker could read arbitrary files on the server; if malicious code can be introduced or executed via the included file, it may lead to code execution, data disclosure, or further compromise of the WordPress site.

The issue affects all releases of the Gyan Elements plugin from the initial version up through 2.2.1. No later versions are known to be vulnerable.

The vulnerability carries a CVSS score of 9.8, indicating a severe potential impact. EPSS scoring shows a very low probability of exploitation (<1%), and the flaw is not yet listed in the CISA KEV catalog. Attackers would likely trigger the LFI by manipulating a user-supplied parameter that the plugin uses directly in an include or require call; the vector would be through an HTTP request to the WordPress site. Success would depend on the ability to locate and read files on the web root or server, and on the server’s configuration allowing execution of included PHP code.