EUVD-2026-43117
GHSA-wcfj-4phh-x3w3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable via HTTP POST, no complexity, subscriber auth required (PR:L), read-only file disclosure with no integrity or availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.76. This is due to the plugin accepting arbitrary local file paths in the template_thumbnail parameter and copying their contents into a publicly accessible uploads file. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary files on the server, which can contain sensitive information.
AnalysisAI
Arbitrary file read in the UnderConstructionPage PRO WordPress plugin (≤ 5.76) exposes sensitive server files to any authenticated subscriber-level user. The plugin's template_thumbnail parameter accepts unsanitized local file paths and copies their contents into the publicly accessible uploads directory, making the exfiltrated data retrievable by unauthenticated third parties after the fact. No public exploit code or CISA KEV listing exists at time of analysis; however, the low privilege bar (subscriber accounts) and high confidentiality impact (CVSS C:H) make this a meaningful risk on multi-user WordPress installations.
Technical ContextAI
CWE-22 (Path Traversal) describes the root cause: the plugin fails to validate or sanitize the template_thumbnail input parameter before using it as a file path in a server-side file copy operation. PHP's file handling functions are invoked with attacker-controlled paths, enabling traversal outside the intended template directory (e.g., ../../wp-config.php). Critically, the copied content is written to the WordPress uploads directory, which is world-readable by default, meaning the extracted file can be retrieved over HTTP without further authentication. The vulnerability exists across all plugin versions through 5.76 on any WordPress installation where the plugin is active. No CPE string was provided in the input data.
RemediationAI
Update the UnderConstructionPage PRO plugin to the version released after 5.76 as documented in the vendor changelog at https://underconstructionpage.com/changelog/; the exact patched release version was not independently confirmed from the provided references (upstream fix exists per vendor advisory). If an immediate update is not possible, restrict subscriber-level and anonymous registration on the WordPress site to remove the attacker's access prerequisite - disabling open user registration under Settings > General reduces exposure significantly, though this trades off against site functionality for membership or e-commerce use cases. As an additional compensating control, consider restricting write access to the uploads directory at the filesystem level or via web server configuration to prevent the plugin from depositing traversed file contents there; note this may break legitimate plugin functionality. Review the uploads directory for any recently created files with unexpected names or extensions that may indicate prior exploitation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today