What is the CVSS score of CVE-2026-0926?

CVE-2026-0926 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-0926?

A critical vulnerability in the Prodigy Commerce WordPress plugin allows unauthenticated attackers to read arbitrary files and execute malicious PHP code on affected servers.

Is there a public PoC exploit available for CVE-2026-0926?

Yes, a public proof-of-concept exploit is available for CVE-2026-0926. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-0926?

Within 24 hours: Identify all WordPress installations using Prodigy Commerce plugin and isolate affected systems from production traffic if possible. Within 7 days: Implement WAF rules to block malicious requests to the vulnerable parameter and disable the plugin if business operations permit. Within 30 days: Remove the plugin entirely, migrate to an alternative solution, or await vendor patch and conduct full security audit of affected systems for indicators of compromise.

PHP CVE-2026-0926

CRITICAL

PHP Remote File Inclusion (CWE-98)

2026-02-19 security@wordfence.com

PHP WordPress RCE Information Disclosure LFI

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 07:17 nvd

CRITICAL 9.8

DescriptionCVE.org

The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.9 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arbitrary files or execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.