Stored cross-site scripting in the Product Addons and Product Options With Custom Fields WordPress plugin (all versions before 1.6.15) lets an unauthenticated attacker abuse an unrestricted file-upload endpoint to plant a malicious SVG that is stored and served inline; its embedded script then runs in the browser session of any user who opens it, including administrators, enabling account takeover. Publicly available exploit code exists and WPScan disclosed the issue, but no public exploit has been identified as used in active attacks. The CVSS 8.8 rating reflects the high impact of hijacking a privileged WordPress session despite the requirement that a victim open the crafted file.
Broken object-level authorization in Onlook through version 0.2.32 allows authenticated attackers to read, modify, and delete other users' projects, members, and chat conversations by passing arbitrary projectId or conversationId UUIDs to tRPC procedures such as project.get, member.remove, and chat.conversation.delete. Because the affected procedures trusted client-supplied identifiers without verifying the caller's ownership, any logged-in user could reach cross-tenant data. Publicly available exploit material exists (VulnCheck advisory and a GitHub issue), and the vendor has shipped a fix in commit 423e2e9, though there is no public exploit identified as being used in active attacks.
Authentication bypass in Eclipse Jetty's HTTP Digest authentication implementation allows an unauthenticated attacker who knows a target username to authenticate as any user whose password contains non-Latin-1 characters (CJK, Cyrillic, Arabic, Greek, emoji, etc.) by substituting those characters with literal '?' characters. The root defect is in DigestAuthentication.java, which uses ISO-8859-1 encoding at three points when computing H(A1), H(A2), and the final MD5 response hash - silently collapsing all code points above U+00FF to 0x3F, making collision credentials cryptographically indistinguishable from the original. A publicly available proof-of-concept demonstrates hash collision across Chinese, Korean, Cyrillic, and Greek passwords; no active exploitation has been confirmed by CISA KEV at time of analysis.
Arbitrary database read in the Events Manager WordPress plugin before 7.3.7 lets unauthenticated bookers inject a malicious serialized PHP object through a booking-registration field on sites running No-User-Account Booking Mode. When the stored booking is later loaded, the object is deserialized without a class allow-list, triggering a gadget chain that reaches an unparameterised SQL query and exposes sensitive data such as user password hashes and secret keys. Publicly available exploit code exists (WPScan) and SSVC rates exploitation as PoC and automatable, though it is not listed in CISA KEV.
Certificate revocation bypass in the Netty netty-handler-ssl-ocsp module (versions before 4.1.136.Final, and 4.2.0.Final through 4.2.15.Final) lets an on-path attacker replay a stale, expired-but-GOOD OCSP response to make OcspServerCertificateValidator accept a certificate that has since been revoked. A missing return statement after the freshness check causes execution to fall through and still fire a VALID OcspValidationEvent even after flagging the response as out-of-date. Publicly available exploit code exists (a PoC unit test is embedded in the GHSA advisory); the issue is not listed in CISA KEV and no EPSS score was provided.
TLS certificate-revocation bypass in Netty's OcspServerCertificateValidator (netty-handler-ssl-ocsp, versions <4.1.136.Final and 4.2.0.Final-4.2.16.Final) allows a malicious server presenting a revoked certificate to receive sensitive client data during a race window. The validator forwards the SslHandshakeCompletionEvent to downstream handlers before the asynchronous OCSP check finishes, so client applications treat the connection as trusted and may transmit or process application data before the revoked channel is closed. Publicly available exploit code exists (PoC in the GHSA advisory); no public active exploitation has been reported and the vulnerability is not in CISA KEV.
Privilege escalation and potential remote code execution affects n8n workflow-automation instances before 2.30.1 and 2.29.8 where both the Token Exchange module and Public API are enabled. Because JWTs issued via Token Exchange are granted the full set of Public API key scopes irrespective of the acting user's role, a low-privileged user holding a valid external JWT trusted by a configured issuer can invoke administrator-only operations - creating, deleting, or escalating users, and, where unverified Community Package installation is permitted, executing arbitrary code. No public exploit identified at time of analysis; VulnCheck-reported with a CVSS 4.0 base of 8.9.
Host-level remote code execution in n8n (n8n-io) occurs when an authenticated user with workflow create or modify permissions crafts a malicious expression that bypasses the sanitizer in the legacy expression evaluator's computed-member handler, executing arbitrary code as the n8n process. Because the legacy expression engine is the default in affected versions, standard deployments are exposed without any special configuration. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and carries a high CVSS 4.0 base score of 8.9.
Server-side remote code execution in n8n workflow automation (self-hosted and cloud) before 1.123.64, 2.29.8, and 2.30.1 lets authenticated users abuse a TOCTOU race in the Git node's clone operation to write a malicious repository into the community node directory, which n8n auto-loads and executes on the next restart. The flaw bypasses path validation by swapping a validated directory for a symlink before the clone runs, turning a low-privilege account into arbitrary JavaScript execution on the host. No public exploit identified at time of analysis; reported by VulnCheck.
OS command injection in the SMASH (Systems Management Architecture for Server Hardware) service of Supermicro X14DBG-DAP and X14DBI platforms lets an authenticated attacker inject operating-system commands through SMASH's input handling on the Baseboard Management Controller (BMC). Successful exploitation yields arbitrary code execution on the BMC, enabling data-integrity tampering or a denial-of-service of the management controller. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Takeover of Oracle Platform Security for Java (OPSS) is possible where a low-privileged attacker with HTTP network access can fully compromise the confidentiality, integrity, and availability of the service. The flaw resides in the Centralized Thirdparty Jars component and affects Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0. It carries a CVSS 3.1 base score of 8.8 and was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access over HTTP to take over the component, per Oracle's July 2026 Critical Patch Update. The flaw yields high confidentiality, integrity, and availability impact and is rated easily exploitable (CVSS 8.8), though no public exploit identified at time of analysis. Because OPSS underpins authentication, authorization, and credential management for the wider Fusion Middleware stack, a takeover has cascading security consequences.
Full compromise of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible when a low-privileged attacker reaches the affected instance over HTTP via the Centralized Thirdparty Jars component. Oracle rates the flaw CVSS 3.1 8.8 and describes it as "easily exploitable," resulting in a complete takeover of OPSS with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and only a low-privilege authenticated prerequisite make it a strong candidate for prompt patching in Oracle environments.
Full takeover of Oracle Platform Security for Java (OPSS) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with network access can compromise the component via crafted SOAP requests. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, meaning successful exploitation yields complete control of the OPSS component rather than mere data exposure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Elevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Access Management (IAM) subsystem generating incorrect security tokens, letting an already-authenticated low-privileged user obtain rights beyond those granted to their account. The flaw is remotely reachable over the network and requires no user interaction, and while the CVSS base score is 8.8 (High), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the impact is full compromise of confidentiality, integrity and availability of the data-protection platform, it should be prioritized in any environment running affected versions.
Stack buffer overflow in FFmpeg's Vulkan HEVC hardware decoder (versions 8.0 through 8.1.2) lets remote attackers overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream, potentially achieving arbitrary code execution. The flaw sits in the vk_hevc_end_frame function, where a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS overflows stack-allocated arrays. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation appears theoretical for now despite the high CVSS 4.0 score of 8.7.
Remote code execution in Franco Corbelli ZPAQFRANZ v.61.3 and earlier allows an attacker to bypass the Mark-of-the-Web (MotW) protection mechanism, potentially leading to arbitrary code execution with the user's privileges. The vulnerability requires user interaction, such as extracting a malicious ZPAQ archive, and no credentials are needed. Exploitation has not been confirmed in the wild, and EPSS estimates a low 0.35% probability, though public proof-of-concept details may exist.
Remote code execution in ZipGenius 6.3.2.3116 and earlier allows attackers to trick users into opening malicious ZIP files, leading to arbitrary code execution with user privileges. No active exploitation or CISA KEV listing exists; EPSS indicates low exploitation probability, but the CVSS base score of 8.8 reflects potential total system compromise.
Remote code execution in OneCommander v3.96.0.0 allows attackers to execute arbitrary code via the main executable component when a user interacts with malicious content. The vulnerability (CWE-693) has a high CVSS score but low EPSS exploitation probability and no known active exploitation. A public GitHub reference exists, suggesting disclosure of technical details, though exploit availability is unconfirmed.
Denial of service in FFmpeg's libavformat RTP/ASF demuxer (versions 0.6.3 through 8.1.2) lets remote attackers exhaust CPU by delivering a crafted RTP/ASF stream. The rtp_asf_fix_header function in rtpdec_asf.c omits a minimum-chunksize check while iterating ASF objects, so a chunksize below the 24-byte ASF object header minimum leaves the loop pointer static and spins forever. There is no public exploit identified at time of analysis, and the flaw impacts availability only (no code execution or data exposure); it was reported by VulnCheck with an upstream fix committed.
Remote code execution in CoffeeZip v4.8.0.0 allows attackers to achieve full system compromise via a crafted archive file. The flaw requires user interaction, with no authentication needed, and has a CVSS score of 8.8 but low EPSS (0.22%) and no evidence of active exploitation.
Remote code execution in NCH ExpressZip v11.29 allows attackers to execute arbitrary code by convincing a user to open a crafted archive file. The vulnerability is a protection mechanism failure (CWE-693) with no authentication required and user interaction needed. No active exploitation or public exploit is confirmed at this time.
Database corruption or site takeover in DB Replacer extension for Joomla versions 1.0.0 through 8.2.7 allows unauthorized backend users or CSRF attacks to perform database replacements, risking major data corruption. The vulnerability arises from inconsistent enforcement of Super User permission and CSRF token validation on administrative routes and replacement requests. No public exploit has been identified at time of analysis, and EPSS estimates a low 0.2% probability of exploitation.
Heap buffer overflow (out-of-bounds write) in FFmpeg's VobSub subtitle demuxer lets an attacker corrupt adjacent heap memory and potentially achieve arbitrary code execution in any application that links FFmpeg's libavformat and processes a malicious .sub/.idx file. All releases from 2.1 through 8.1.2 are affected. A vendor patch exists (commit dbd495f) and the issue was reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
We are tasked with generating a JSON analysis for CVE-2026-63280. We have the description, CVSS, CWE, EPSS, SSVC, tags, affected products, references. Need to synthesize all. Let's break down the input: - CVE: CVE-2026-63280 - Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." - CVSS: 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE: CWE-352 (Cross-Site Request Forgery) - EPSS: 0.13% (percentile 3%) - Reported by: Joomla - CPE: multiple from regularlabs.com for extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, Rereplacer Pro) for Joomla. - Tags: CSRF, and the extension names. - SSVC: Exploitation: none, Automatable: no, Technical Impact: total - ENISA EUVD-ID: EUVD-2026-47812 - Affected versions from EUVD: listed for each extension. - References: [cveorg] (None) https://regularlabs.com/ ... maybe missing advisory? Only link to vendor homepage. No specific advisory. So patch status unclear. We need to produce a comprehensive analysis. First, product_name: The vulnerability affects multiple extensions from Regular Labs for Joomla. The primary affected product is a set of extensions, but we need to pick a concise name. Could be "Regular Labs Joomla extensions" or the specific one? Since it's multiple, maybe "Advanced Module Manager" or one of them. Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." That sounds like CSRF and permission issues in the admin interface of these extensions. From tags: CSRF. So likely a CSRF vulnerability in all these extensions. The CWE is CWE-352, consistent. Product name: I'll pick "Regular Labs Joomla Extensions" but that might be 3 words. Alternatively, the primary extension mentioned first in tags: "Advanced Module Manager Extension For Joomla" but that's many words. I'll go with "Regular Labs Extensions" (2 words) or "Regular Labs for Joomla"? The instruction
Insufficient access controls in Regular Labs Extension Manager for Joomla (versions 1.0.0–9.2.5) allow an unauthenticated attacker via CSRF or a low-privilege backend user to install, update, or remove extensions. Successful exploitation can lead to complete site compromise through the installation of a malicious extension. EPSS probability is low (0.13%) and no active exploitation or public exploit code has been identified.
Missing CSRF tokens, item-permission, and input-validation checks in Regular Labs Joomla extensions (Content Templater, ReReplacer, Snippets) allow unauthorized backend users or CSRF attacks to expose, create, or modify extension configuration and items. This high-severity flaw (CVSS 8.8) affects multiple versions, with low exploitation probability (EPSS 0.13%). No active exploitation or public exploit code has been identified.
Out-of-bounds read and write in the FFmpeg ADX audio decoder (libavcodec/adxdec.c) affects versions 4.4 through 8.1.2, where a mid-stream channel layout change corrupts memory. When AV_PKT_DATA_NEW_EXTRADATA side data arrives mid-stream, adx_decode_frame re-parses the header but leaves the internal channel state stale, so later decode operations index the prev[] state array with a wrong channel count. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw enables both reads and writes and carries a CVSS 4.0 base score of 8.7.
Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. No public exploit identified at time of analysis; a vendor upstream fix commit is available, and CVSS 4.0 is rated 8.7 (High).
MFA bypass in NetApp ONTAP 9.16.1 and later occurs when WebAuthn multi-factor authentication is configured, stemming from improper handling of the WebAuthn Relying Party ID. An attacker who already holds valid credentials can defeat the second authentication factor and gain full administrative access to the storage management plane. No public exploit identified at time of analysis; the flaw is vendor-reported by NetApp and not listed in CISA KEV.
Local privilege escalation in the servereye Windows agent (Sensorhub / ClientAgentContainerService) versions 20.15 and earlier lets any local standard user gain SYSTEM. The SYSTEM-level SE3Recovery service (EmergencyRecoveryService.exe) watches a world-writable directory for a trigger file and then runs UpdaterAction.exe, which performs an unvalidated file copy from a user-controlled source over a protected service binary, resulting in full system compromise. No public exploit identified at time of analysis; this was reported by NCSC.ch and is not listed in CISA KEV, so there is no evidence of active exploitation.
Denial of service in Netty's bzip2 compression codec allows remote unauthenticated attackers to permanently hang an event-loop thread by sending a malformed bzip2 stream, affecting applications that use the Bzip2Decoder in netty-codec (< 4.1.136.Final) or netty-codec-compression (>= 4.2.0.Final, < 4.2.16.Final). The flaw is an infinite loop (CWE-835) in the run-length-encoding state machine of Bzip2BlockDecompressor.read(), which never terminates on crafted input and starves the shared Netty I/O thread pool. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.
Privilege escalation in the Grav CMS Login plugin (grav-plugin-login) <= 3.8.11 lets a low-privilege authenticated user promote their own account to super-admin by injecting privilege fields into a profile self-update request. The flaw lives in processUserProfile() (the update_user task), which — unlike the registration handler — fails to strip 'groups' and 'access' from user-submitted form data before persisting it. There is no public exploit identified at time of analysis and it is not in CISA KEV, but exploitation is trivial once the exposing configuration is present, and gaining super-admin unlocks admin panel access, scheduler-driven RCE, and Twig evaluation.
Authorization bypass in MongoDB Server allows an authenticated low-privileged user to read and write documents that should be shielded by role-based, query-level access controls. Because the server insufficiently validates certain client-supplied command parameters, crafted find, update, delete, and aggregate commands can sidestep the access boundaries enforced for a user's role. The flaw only manifests in non-apiStrict deployments (the default), and per the vendor CVSS 4.0 vector it yields high confidentiality and integrity impact; no public exploit has been identified at time of analysis.
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling a signed zone to inject validly-signed NSEC records whose 'Next Domain Name' field points outside the signer's own zone, letting forged proofs of non-existence be applied to names the zone was never authorized to speak for. Because BIND fails to enforce that the NSEC chain stays within the signer's authority, an attacker can assert that arbitrary names in other zones do not exist, poisoning resolver behavior across zone boundaries (CVSS 8.6, Scope:Changed, integrity impact). There is no public exploit identified at time of analysis and the issue is not in CISA KEV.
Authentication bypass in Next.js App Router built with Turbopack when using a single i18n locale allows unauthenticated attackers to circumvent middleware or proxy‑based authentication via crafted requests. The vulnerability affects Next.js versions 16.0.0 through 16.2.10, and is exploitable without any user interaction. A patch is available in version 16.2.11.
Server-Side Request Forgery (SSRF) and open redirect in Next.js rewrite/redirect rules when the destination hostname is dynamically constructed from user-controlled input. Versions 12.0.0 to 15.5.20 and 16.0.0 to 16.2.10 are affected, allowing a remote attacker to proxy requests to arbitrary hosts or redirect users. Patched versions 15.5.21 and 16.2.11 are available; no active exploitation has been reported.
Local privilege escalation in Fujitsu openFT (managed file transfer) on GNU/Linux and Oracle Solaris allows an already-authenticated local user to gain root privileges on versions before 12.1D00. The flaw stems from improper privilege management (CWE-269) and carries a CVSS 4.0 base score of 8.5 (High). No public exploit identified at time of analysis; the intelligence was obtained internally by the Fsas Technologies PSIRT rather than from public disclosure.
Stored DOM cross-site scripting in n8n's Resource Locator component allows a low-privileged workflow author to execute arbitrary JavaScript in another user's browser session. The flaw stems from the workflow-persisted cachedResultUrl value being passed to window.open() without scheme validation, letting a javascript: URI fire when a victim opens the crafted workflow and clicks an external link. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but exploitation is realistic in shared/multi-tenant n8n instances.
OS command injection in MongoDB Compass allows an attacker to smuggle a malicious 'browser open command' for the OIDC authentication flow into an importable connection file, a setting normally restricted to global Compass application settings and not editable through the connection form. When a victim imports the crafted connection and initiates OIDC authentication, the attacker-controlled command executes on the victim's host with the user's privileges. No public exploit identified at time of analysis, but the CVSS 4.0 base score is 8.4 (High) reflecting full compromise of confidentiality, integrity, and availability of the local system.
Local privilege escalation in the Veeam Updater component of the Veeam Software Appliance allows a high-privileged local user to reach root-level control of the underlying operating system via path traversal (CWE-22). The flaw affects Veeam Backup & Replication deployed as the hardened software appliance, carries a CVSS 4.0 base score of 8.4, and was reported through HackerOne. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so current risk is latent rather than actively exploited.
Server-Side Request Forgery in the Vercel Next.js framework (versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10) lets a remote attacker who controls Host-associated headers coerce a Server Action's forwarded or redirected request to an attacker-chosen host, and in some setups leak internal values that weaken middleware/proxy authorization. Exploitation is limited to deployments where the incoming Host header is not pinned to a trusted value - typically custom servers or setups not fronted by a host-pinning proxy. There is no public exploit identified at time of analysis, EPSS is low (0.62%, 46th percentile), and CISA SSVC rates exploitation as 'none' with partial technical impact.
DOM-based cross-site scripting in n8n's HTML preview lets an authenticated global:member user execute JavaScript in the editor's same origin when a victim opens the preview. Because execution output is rendered into an iframe srcdoc without the sandbox attribute and a sanitizer bypass defeats the filtering, injected script runs same-origin and can invoke authenticated APIs using the victim's session, enabling account and workflow takeover. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
Denial of service in Next.js App Router with Server Actions allows remote attackers to exhaust CPU resources and block request processing. Affected versions include all 13.0.0–15.5.20 and 16.0.0–16.2.10 releases. No active exploitation or public exploit code has been identified at time of analysis.
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistence storage provider derives its storage key from user-controlled input, letting a remote attacker steer a path traversal into attacker-controlled deserialization. Because the CVSS vector is PR:N/UI:N, an unauthenticated remote attacker can chain the traversal to load a crafted serialized payload and execute arbitrary code, though the AC:H rating signals the attack is non-trivial to reliably trigger. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resolution in the persistence framework, where attacker-influenced persisted state is deserialized into arbitrary object types. Network-reachable attackers can leverage this to run arbitrary code on the hosting web server, though the CVSS High attack complexity (AC:H) indicates exploitation depends on influencing persisted state rather than a trivial single request. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the deserialization class and product history warrant urgent patching.
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state via cookie-based storage in RadPersistenceManager or RadDockLayout, causing the components to deserialize attacker-supplied cookie payloads. An unauthenticated remote attacker who can reach the application and craft a malicious serialized cookie can achieve code execution on the server. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; EPSS data was not provided.
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metadata so that the AsyncUploadTypeName value drives unsafe, attacker-controlled type resolution, letting them instantiate arbitrary types and run code on the hosting server. The flaw sits in the RadAsyncUpload (RAU) handler, historically an unauthenticated endpoint (CVSS PR:N), and carries an 8.1 High score tempered by AC:H, reflecting the crafting/forgery effort required. At time of analysis there is no public exploit identified and it is not in CISA KEV, though the same component has a long history of weaponized deserialization bugs.
Arbitrary file deletion in the WP Foodbakery WordPress plugin (all versions through 4.9) lets authenticated users with only subscriber-level access delete any file the web server can reach, because the 'delete_locations_backup_file_callback' handler fails to validate the supplied path. Deleting a critical file such as wp-config.php can cascade into remote code execution, which is why Wordfence tags this as an RCE-class issue. No public exploit has been identified at the time of analysis, but the high CVSS (8.1) and trivially low privilege bar make it a strong patching priority.