Panorama Viewer CVE-2026-57647

Exploitation requires an authenticated WordPress account with at least Contributor privileges (CVSS PR:L), so the site must permit Contributor-level (or higher) accounts - open registration, multi-author publishing, or compromised low-tier credentials. The attack is network-reachable with no user interaction (AV:N/UI:N) but is rated high complexity (AC:H), implying the attacker must satisfy non-trivial conditions such as crafting a specific parameter value or meeting timing/path requirements rather than a single trivial request. The principal limiting factors are the Contributor authentication gate and the AC:H complexity; sites that do not grant untrusted users any authoring role are largely insulated, and the depth of impact (whether disclosure only or escalation to code execution) further depends on server-side PHP and filesystem configuration.

Signals are mixed and point to a real-but-gated risk rather than a mass-exploitation emergency. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.5) indicates network reachability with full triad impact but two meaningful brakes: high attack complexity (AC:H) and the requirement for at least Contributor privileges (PR:L), so an attacker must already hold a low-trust authenticated account on the WordPress site. There is no EPSS score, no SSVC decision data, and no KEV listing in the provided input, and no POC was referenced - meaning automation potential and in-the-wild interest are presently unquantified. The C:H/I:H/A:H impact rating from Patchstack is on the aggressive end for an LFI; confidentiality impact is well-supported (config/secret disclosure), while the high integrity/availability ratings presume LFI-to-RCE chaining that depends on server configuration and is not confirmed in the description. Net: prioritize on sites that allow untrusted Contributor registrations or multi-author setups; for tightly controlled single-author sites the practical risk is lower.

An attacker registers or compromises a Contributor account on a WordPress site running Panorama Viewer <= 1.6.1, then submits a crafted request that manipulates the plugin's file-inclusion parameter to point at a sensitive local path such as wp-config.php. Despite the high attack complexity, a successful request returns or executes the targeted file, leaking database credentials and secret keys that enable deeper compromise. No public POC was referenced in the provided intelligence, so working exploitation would require attacker-developed tooling.