Golo Framework CVE-2026-28150

Exploitation requires the Golo Framework WordPress plugin (versions below 1.7.5) to be installed and active on a publicly reachable WordPress installation. The CVSS vector confirms no authentication is required (PR:N) and no user interaction is needed (UI:N). High attack complexity (AC:H) indicates additional server-side conditions must be satisfied - exact conditions are not specified in the available advisory, but likely candidates include PHP configuration state (open_basedir disabled or broadly scoped, specific PHP version behavior), or a particular plugin configuration mode. Exploitation is strictly limited to WordPress sites running this plugin; the vulnerability does not affect WordPress core or other plugins. Escalation from arbitrary file read to remote code execution is not automatic - it requires a secondary condition such as an attacker-writable file path that PHP can include (log poisoning, session file injection, or an upload directory within the PHP path).

The CVSS 3.1 score of 8.1 reflects a network-accessible (AV:N), unauthenticated (PR:N) attack with high complexity (AC:H) and uniformly high impact across confidentiality, integrity, and availability. The AC:H rating is the primary moderating factor - it signals that specific server-side conditions must align for exploitation to succeed, possibly relating to PHP configuration directives (open_basedir, allow_url_include), file system permissions, or a particular plugin state not detailed in available data. No EPSS data was provided, so exploitation probability cannot be quantified against the broader threat landscape. The vulnerability is absent from the CISA KEV catalog, confirming no observed active exploitation at time of analysis. No public POC has been identified. Despite these moderating signals, the unauthenticated network vector and the high-value disclosure target (wp-config.php exposes database credentials that can pivot to full site compromise) mean remediation priority should be elevated above the AC:H modifier suggests. The 'local' in Local File Inclusion does not limit network reachability - the attack is delivered remotely even though the included files are local to the server, consistent with AV:N.

An unauthenticated attacker identifies a WordPress installation running Golo Framework below 1.7.5 and sends a crafted HTTP GET or POST request with a manipulated file path parameter - such as ../../../../wp-config.php or /etc/passwd - to the vulnerable plugin endpoint. The PHP application passes the parameter unsanitized to an include() or require() call, returning the file contents in the HTTP response. No public exploit code has been identified at time of analysis, but PHP LFI exploitation is well-understood and achievable without specialized tooling; if the attacker can also write PHP-containing content to an accessible log file, escalation to remote code execution via log poisoning is a realistic follow-on step.