Description
Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
Published: 2026-08-24
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Local File Inclusion leading to potential information disclosure or remote code execution
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows an unauthenticated attacker to include arbitrary local files through the Verdure Core plugin in WordPress. This can expose sensitive server data or enable the execution of attacker‑supplied code, depending on the files accessed. The weakness is identified as CWE‑98 and is classified as a high‑severity flaw with a CVSS score of 8.1.

Affected Systems

The vulnerability affects the Elated‑Themes Verdure Core plugin for WordPress, specifically versions 1.2 and all earlier releases.

Risk and Exploitability

The CVSS score of 8.1 indicates a high impact potential. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, where an attacker can craft a request to the plugin’s file inclusion endpoint without needing authentication. If successful, the attacker can read arbitrary files and may execute code from included files, thereby compromising the integrity and confidentiality of the system.

Generated by OpenCVE AI on August 24, 2026 at 13:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Verdure Core to version 1.3 or later, which contains the fix for the Local File Inclusion flaw.
  • If upgrading is not immediately possible, remove or deactivate the Verdure Core plugin to eliminate the attack surface.
  • Deploy a web application firewall or similar controls to block requests that attempt to include arbitrary files within the WordPress installation.
  • Ensure that directory permissions are set so that non‑executables cannot be accessed via PHP, reducing the chance of malicious code execution.

Generated by OpenCVE AI on August 24, 2026 at 13:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Elated-themes
Elated-themes verdure Core
Wordpress
Wordpress wordpress
Vendors & Products Elated-themes
Elated-themes verdure Core
Wordpress
Wordpress wordpress

Mon, 24 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
Title WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Elated-themes Verdure Core
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-24T12:51:09.760Z

Reserved: 2026-07-27T14:00:48.793Z

Link: CVE-2026-66671

cve-icon Vulnrichment

Updated: 2026-08-24T12:49:34.697Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T12:16:53.880

Modified: 2026-08-24T16:40:53.647

Link: CVE-2026-66671

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T21:11:24Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')