CVE-2026-66671

WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability

View on CVE.org
Published Aug 24, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.

Analysis

AI-generated

Technical impact

The vulnerability allows an unauthenticated attacker to include arbitrary local files through the Verdure Core plugin in WordPress. This can expose sensitive server data or enable the execution of attacker‑supplied code, depending on the files accessed. The weakness is identified as CWE‑98 and is classified as a high‑severity flaw with a CVSS score of 8.1.

Affected Systems

The vulnerability affects the Elated‑Themes Verdure Core plugin for WordPress, specifically versions 1.2 and all earlier releases.

Risk and Exploitability

The CVSS score of 8.1 indicates a high impact potential. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, where an attacker can craft a request to the plugin’s file inclusion endpoint without needing authentication. If successful, the attacker can read arbitrary files and may execute code from included files, thereby compromising the integrity and confidentiality of the system.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Verdure Core to version 1.3 or later, which contains the fix for the Local File Inclusion flaw.
  • If upgrading is not immediately possible, remove or deactivate the Verdure Core plugin to eliminate the attack surface.
  • Deploy a web application firewall or similar controls to block requests that attempt to include arbitrary files within the WordPress installation.
  • Ensure that directory permissions are set so that non‑executables cannot be accessed via PHP, reducing the chance of malicious code execution.

Generated by OpenCVE AI on August 24, 2026 at 13:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Elated-themes
Elated-themes verdure Core
Wordpress
Wordpress wordpress
Vendors & Products Elated-themes
Elated-themes verdure Core
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
Title WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Aug 24, 2026, 12:51 PM
Reserved
Jul 27, 2026, 2:00 PM

View source JSON

Updated
Aug 24, 2026, 12:49 PM

JSON

Status
Deferred
Published
Aug 24, 2026, 12:16 PM
Modified
Oct 12, 2026, 3:10 PM

View source JSON

No data.

Updated
Aug 24, 2026, 9:11 PM

JSON