Academist Core CVE-2026-112820

Exploitation requires that the target site runs the Academist Core plugin (version up to and including 1.4.1) and reaches a code path where attacker-influenced input flows into a PHP include/require statement; the specific endpoint, parameter, and feature that trigger the inclusion are not described in the available sources. Limiting factors: the CVSS vector sets AC:H, meaning the attacker must satisfy conditions they do not fully control (such as a resolvable local path or particular request state) for the include to succeed, which constrains reliable or automated exploitation. No authentication (PR:N) and no user interaction (UI:N) are required per the vector. As described this is Local File Inclusion, so an attacker is limited to files already present on the server rather than remote URL inclusion.

This is a network-reachable, unauthenticated PHP Local File Inclusion (CWE-98) in the Elated-Themes Academist Core WordPress plugin, scored CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The AV:N/PR:N/UI:N portion means a remote attacker needs no credentials and no victim interaction, which raises concern; however AC:H indicates the attacker must satisfy conditions outside their control (e.g. a specific path, parameter state, or filesystem layout), which tempers the likelihood of trivial mass exploitation. The reporting source is Patchstack and the vuln.today Decision label is 'this_week', indicating a prioritize-this-week posture rather than emergency. There is NO CISA KEV listing and NO EPSS score provided in the input, so exploitation-probability and active-exploitation signals are simply absent - not low, but unmeasured - and no SSVC automatable/technical-impact fields were supplied. Note a classification tension: the CWE title references 'PHP Remote File Inclusion' and the type is 'Improper Control of Filename for Include/Require Statement', but the description explicitly states the impact is Local File Inclusion; treat this as LFI (local files reachable via the include path), not remote URL inclusion, unless the vendor confirms otherwise. Net: a genuine high-severity issue worth near-term patching for anyone running this plugin, but the attack complexity and the absence of KEV/EPSS/working-exploit evidence argue against treating it as an active mass-exploitation emergency.

A remote, unauthenticated attacker sends a crafted request to a vulnerable Academist Core endpoint that passes attacker-influenced input into a PHP include/require statement, causing a local file on the WordPress host (such as wp-config.php or another sensitive file) to be included and disclosed or executed. Because the CVSS vector is AC:H, the request must meet specific conditions for the inclusion to resolve to a useful file, so success is not guaranteed on a single attempt. No public exploit is identified in the provided data; the only reference is the Patchstack advisory page.