EUVD-2026-39762
GHSA-3h77-4vh2-mhwg
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Contributor login needed (PR:L) and non-trivial conditions (AC:H); LFI reliably discloses secrets (C:H), but integrity/availability impact is conditional on RCE chaining, so I:L/A:L.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Contributor Local File Inclusion in Panorama Viewer - 360 Degree Image + Video Viewer <= 1.6.1 versions.
Articles & Coverage 1
AnalysisAI
Local File Inclusion in the Panorama Viewer - 360 Degree Image + Video Viewer WordPress plugin (versions 1.6.1 and earlier) allows authenticated users with Contributor-level access to coerce the application into including arbitrary local files on the server. Cataloged under CWE-98 and reported by Patchstack, the flaw can expose sensitive files (e.g., wp-config.php credentials) and, depending on server conditions, escalate toward code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.
Technical ContextAI
The vulnerability lies in the PHP include/require handling of the Panorama Viewer plugin, a WordPress extension that renders 360-degree image and video panoramas. CWE-98 (Improper Control of Filename for Include/Require Statement in a PHP Program) means an attacker-influenced parameter flows into a file-inclusion call without adequate sanitization or allow-listing, letting the application load files outside the intended scope. Because the plugin executes within the WordPress/PHP runtime, an included PHP file is interpreted rather than merely read, which is why LFI in this class can read configuration secrets and, where attacker-controlled content can be staged (uploads, logs, session files), bridge toward remote code execution. Exact affected CPE strings were not provided in the NVD data; the only authoritative identifier is the plugin slug 'panorama' as referenced in the Patchstack advisory.
RemediationAI
No vendor-released patch version is identified in the available data, so confirm the latest release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/panorama/vulnerability/wordpress-panorama-viewer-360-degree-image-video-viewer-plugin-1-6-1-local-file-inclusion-vulnerability?_s_id=cve) and the WordPress plugin repository, then upgrade to any release later than 1.6.1 once published. Until a fixed version is verified, the most effective compensating control is to remove or deactivate the Panorama Viewer plugin, which eliminates the vulnerable code path at the cost of losing 360-degree viewer functionality. Because exploitation requires a Contributor account, also restrict who can hold Contributor (or higher) roles: disable open user registration or downgrade untrusted authors, accepting that legitimate multi-author workflows are curtailed. As a network-layer mitigation, deploy a WAF rule (e.g., Patchstack vPatch) to block path-traversal and file-inclusion patterns in requests to the plugin's endpoints, recognizing WAF rules can be bypassed and may cause false positives on legitimate panorama media URLs.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-98 – PHP Remote File Inclusion
View allShare
External POC / Exploit Code
Leaving vuln.today