EUVD-2026-48088
GHSA-5cr5-8xh5-2f28
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Local File Inclusion in the Tonda Core WordPress plugin (versions 2.1.2 and earlier by Select Themes) allows an authenticated user with only Contributor-level privileges to force the PHP application to include arbitrary local files, exposing sensitive server-side content and potentially escalating to code execution. The flaw was reported by Patchstack and is classified as CWE-98 (PHP file inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Tonda Core gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.
Articles & Coverage 1
Executive ViewAI
The Tonda Core WordPress plugin (versions 2.1.2 and earlier) contains a local file inclusion vulnerability exploitable by authenticated users with Contributor-level privileges, enabling exposure of sensitive server files and potential code execution. Organizations running this plugin must immediately audit deployment scope and implement access controls, as no vendor patch is currently available.
Within 24 hours, inventory all WordPress instances using Tonda Core plugin versions 2.1.2 or earlier and document business criticality; determine whether active use justifies retention. Within 7 days, if the plugin cannot be deactivated, restrict Contributor role assignments to trusted personnel only and implement Web Application Firewall rules blocking requests to sensitive files (wp-config.php, .env, /etc/passwd patterns). Within 30 days, monitor Select Themes advisory channels for patch releases; upon availability, test and deploy the patched version immediately, or evaluate and migrate to an alternative plugin if Select Themes does not release a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the plugin if operationally feasible; (2) Restrict Contributor role permissions to minimal necessary users; (3) Deploy WAF rules targeting LFI attack patterns; (4) Enable file integrity monitoring on wp-config.php and other sensitive configuration files; (5) Increase logging and alerting on authenticated file access requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB