What is the CVSS score of CVE-2026-34894?

CVE-2026-34894 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Integrio Core are affected by CVE-2026-34894?

A remote file disclosure vulnerability in the Integrio Core WordPress plugin (pre-1.2.8) exposes source code and sensitive configuration data on affected WordPress instances without requiring…. A patch is available.

How to fix or mitigate CVE-2026-34894?

24 hours: Scan your WordPress fleet for Integrio Core plugin installations and determine version inventory. 7 days: Update all Integrio Core installations to version 1.2.8 or later; test the patch in a staging environment first for compatibility. 30 days: Review access logs from the vulnerable period for indicators of exploitation and conduct credential rotation for any exposed database credentials or API keys.

Integrio Core CVE-2026-34894

EUVD-2026-37466 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP WordPress Information Disclosure LFI Wordpress Plugin Integrio Core Webgeniuslab

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable WordPress endpoint with no auth (AV:N/PR:N/UI:N); AC:H reflects the disclosed non-trivial exploitation; LFI primarily leaks files (C:H) with limited direct integrity/availability impact absent a chained RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:43 vuln.today

Patch available

Jun 16, 2026 - 23:02 EUVD

DescriptionCVE.org

Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the Integrio Core WordPress plugin (versions prior to 1.2.8) by webgeniuslab allows remote attackers to coerce the PHP application into including arbitrary local files, leading to source code disclosure, sensitive file exposure, and potentially remote code execution when log poisoning or upload primitives are available. The CVSS vector (AV:N/AC:H/PR:N/UI:N) reflects network-reachable, unauthenticated exploitation with high attack complexity, and no public exploit identified at time of analysis. The flaw is tracked by Patchstack and ENISA EUVD (EUVD-2026-37466) with a vendor-released patch in version 1.2.8.

Technical ContextAI

Integrio Core is a supporting WordPress plugin distributed by webgeniuslab (CPE cpe:2.3:a:webgeniuslab:integrio_core), commonly bundled with the Integrio theme to expose shortcodes, widgets, and AJAX endpoints. The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), meaning a user-controlled value reaches a PHP include/require call without adequate normalization, allowing path traversal sequences or absolute paths to load files outside the intended template directory. In the WordPress context this typically manifests through an unauthenticated admin-ajax.php or REST endpoint that maps a request parameter (such as a template, view, or layout name) directly into an include statement, exposing wp-config.php and any other readable PHP source on the host.

RemediationAI

Vendor-released patch: Integrio Core 1.2.8 - upgrade the plugin via the WordPress admin Plugins screen or by replacing the plugin directory with the 1.2.8 release, as referenced in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/integrio-core/vulnerability/wordpress-integrio-core-plugin-1-2-8-local-file-inclusion-vulnerability). Until the upgrade is applied, deploy a virtual patch / WAF rule that blocks requests containing path traversal sequences (../, %2e%2e%2f, encoded null bytes, and absolute paths beginning with / or php://) against admin-ajax.php and the plugin's REST routes; the trade-off is potential false positives on legitimate admin requests using encoded characters. As a more invasive interim control, deactivate the Integrio Core plugin, which will break Integrio-theme shortcodes and front-end widgets that depend on it, or restrict access to /wp-admin/admin-ajax.php and the plugin endpoints via HTTP auth or IP allowlist on the web server.