MDTF Plugin CVE-2026-54845

Exploitation targets a network-reachable WordPress site running the MDTF plugin at version 1.3.8 or earlier with the plugin active and its filtering functionality exposed; no authentication is required (PR:N). The key limiting factor is the High attack complexity (AC:H): successful exploitation depends on conditions the attacker does not fully control - likely a specific plugin/filter configuration, a valid or guessable target file path, or a particular request encoding - rather than a straightforward single request against a default install. No user interaction is required (UI:N). The exact triggering parameter and required configuration are not detailed in the available data and should be confirmed against the Patchstack advisory.

The signals are mixed and warrant careful triage. CVSS 8.1 is driven by network reach, no authentication (PR:N), and full High confidentiality/integrity/availability impact - but the AC:H qualifier indicates the attacker must satisfy conditions outside their control (e.g. a specific filter configuration, predictable path, or race/encoding requirement), which materially lowers real-world ease of exploitation versus a clean AC:L LFI. No EPSS score, KEV listing, SSVC decision, or POC was provided, so there is no evidence of active or automatable exploitation; the absence of these is itself a data gap rather than a guarantee of low risk. The Patchstack 'Information Disclosure' tag and the LFI nature suggest the realistic primary impact is reading sensitive files (e.g. wp-config.php) rather than guaranteed RCE, despite the I:H/A:H scoring. Net: treat as a meaningful but not emergency priority - patch promptly given unauthenticated reachability, but the AC:H and lack of exploit evidence argue against panic-level urgency.

A remote, unauthenticated attacker sends a crafted request to the plugin's filter endpoint, injecting a manipulated file path (e.g. traversal toward wp-config.php) into the parameter that feeds a PHP include/require. Because AC:H applies, the attacker must first satisfy specific preconditions - such as a particular filter or taxonomy configuration or a correctly encoded path - but on success can read sensitive local files and potentially execute PHP. No public proof-of-concept was identified at time of analysis.