What is the CVSS score of CVE-2026-54845?

CVE-2026-54845 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of MDTF Plugin are affected by CVE-2026-54845?

The WordPress Meta Data and Taxonomy Filter plugin (versions ≤1.3.8) contains an unauthenticated remote local file inclusion vulnerability (CVE-2026-54845, CVSS 8.1) that allows attackers to read…

How to fix or mitigate CVE-2026-54845?

Within 24 hours: Audit all WordPress installations for MDTF plugin presence and document affected versions. Within 7 days: Deactivate or remove the vulnerable plugin from all instances; if business-critical, implement network access controls or WAF rules targeting local file inclusion patterns. Within 30 days: Monitor pluginus.net for patched version (≥1.3.9) and establish routine plugin update procedures.

MDTF Plugin CVE-2026-54845

EUVD-2026-39372 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-25 Patchstack

GHSA-4grh-jfx7-w6hc

LFI Information Disclosure PHP Mdtf

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.7 HIGH

Unauthenticated network LFI (AV:N/PR:N) with non-trivial preconditions (AC:H); high confidentiality and possible code inclusion (C:H/I:H), but availability impact is more limited (A:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:20 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.

Articles & Coverage 1

News 3 New PHP Vulnerabilities - 3 High Severity, 1 With POC Jun 26, 2026

AnalysisAI

Unauthenticated local file inclusion in the WordPress 'Meta Data and Taxonomy Filter' (MDTF) plugin by pluginus.net affects all versions up to and including 1.3.8, allowing remote attackers without credentials to coerce the PHP application into including arbitrary local files. Per its CVSS:3.1 vector (AV:N/PR:N), exploitation is network-reachable and unauthenticated, though the high attack complexity (AC:H) implies non-trivial preconditions. This is classified as information disclosure but rated 8.1 with full C/I/A impact; there is no public exploit identified at time of analysis and it is not on the CISA KEV list.

Technical ContextAI

MDTF is a PHP-based WordPress plugin that provides meta-data and taxonomy filtering of post content. The flaw is CWE-98 (Improper Control of Filename for Include/Require Statement), the LFI/RFI class in which user-influenced input flows into a PHP include/require statement without adequate sanitization or allowlisting. In WordPress this typically occurs through an AJAX action, shortcode handler, or query parameter that builds a filesystem path from request data, letting an attacker traverse directories or include unexpected PHP files. The affected component is identified by CPE cpe:2.3:a:pluginus.net:mdtf:*, i.e. the pluginus.net MDTF plugin across all listed versions.

RemediationAI

No vendor-released patch version was identified at time of analysis; the data only confirms that versions up to and including 1.3.8 are vulnerable. Administrators should upgrade to any vendor release later than 1.3.8 once confirmed available, monitoring the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-plugin-1-3-8-local-file-inclusion-vulnerability) and the plugin's WordPress.org listing for a fixed version. Until a patch is confirmed, compensating controls include deactivating and removing the MDTF plugin if the filtering feature is non-essential (trade-off: loss of taxonomy/meta filtering on the site), and deploying a WAF rule or ruleset to block path-traversal sequences and suspicious file paths in requests to the plugin's AJAX/filter endpoints (trade-off: rules may be bypassable via encoding and require tuning to avoid false positives). Restricting filesystem permissions and ensuring PHP allow_url_include is off limits the worst-case impact but does not stop local file reads.