Tonda Core CVE-2026-28152

The Tonda Core plugin must be installed and active on the target WordPress installation running PHP. A user-supplied parameter accepted by the plugin is passed without sanitization to a PHP file-include function, requiring no authentication (PR:N per CVSS). The AC:H rating indicates that full exploitation - particularly integrity and availability impact - requires a secondary enabling condition beyond network access, most plausibly the ability to write attacker-controlled content to a PHP-executable path (log poisoning via the web server error log or a writable upload directory). Base-level file disclosure (C:H) may be achievable without the secondary condition against predictable file paths. PHP hardening controls such as open_basedir restrictions limit the reachable filesystem scope and reduce practical impact even when the LFI is triggered. Exploitation is constrained to the local server filesystem - this is Local File Inclusion, not Remote File Inclusion.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1 and reflects a network-reachable, unauthenticated attack path with full impact - but the AC:H component is a meaningful constraint, indicating at least one non-default or race condition must be satisfied beyond network access (likely log poisoning, predictable file paths, or a specific server layout) to reach the worst-case RCE scenario. The immediate, unconditional impact is file disclosure (C:H), while integrity and availability impact require the secondary escalation path. No EPSS score was supplied, the vulnerability is absent from the CISA KEV catalog, and no confirmed public proof-of-concept exists at time of analysis, so opportunistic mass exploitation at scale is not evidenced. The Patchstack advisory and ENISA EUVD-2026-64791 confirm the finding. A vendor patch exists at version 2.6, substantially reducing residual risk for upgraded installations. Overall this is a real, elevated-priority issue for any site running the plugin below 2.6, but the AC:H constraint and absence of confirmed exploitation distinguish it from imminent, automated mass-exploitation threats.

An unauthenticated attacker identifies a WordPress site running Tonda Core below 2.6 and sends a crafted HTTP GET request with a directory-traversal payload in a vulnerable parameter, causing the plugin to include and return the contents of wp-config.php, exposing database credentials and authentication keys. If the attacker can write attacker-controlled PHP content to a server-accessible path - for example by uploading an image containing PHP code and then including it via the LFI - the exploit escalates to arbitrary code execution under the web server process account. No public exploit code has been confirmed at time of analysis.