Biagiotti Core CVE-2026-66657

No authentication is required per the CVSS PR:N metric - exploitation is possible by any unauthenticated remote attacker with network access to the WordPress site. The AC:H metric confirms that exploitation is not reliable against default configurations and requires specific conditions: most likely a server environment where log files or session files are readable via the webroot, or a specific PHP configuration enabling inclusion of files outside the plugin's intended directory. The vulnerability is limited to WordPress installations running the Biagiotti Core plugin at version 2.1.1 or earlier. The exact plugin feature or parameter responsible for the file inclusion is not specified in the available advisory data and must be confirmed via the Patchstack report. Exploitation to achieve I:H and A:H (beyond file read) is further limited by the need to chain LFI with a writable and includable file on the target system.

The CVSS 8.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H presents a mixed picture. The unauthenticated, network-accessible nature (AV:N, PR:N, UI:N) is a high-priority signal, as it requires no existing foothold. However, AC:H explicitly indicates that exploitation is not trivial and depends on conditions beyond the attacker's direct control - this is likely a multi-step or configuration-dependent exploitation path to reach I:H and A:H (full RCE). For sites where only file disclosure is achievable, the effective impact is C:H with I:N/A:N. No EPSS score was provided, no KEV listing exists, and no POC has been confirmed, which collectively suggest this is not yet under widespread active exploitation. The realistic priority depends heavily on whether the target server's PHP configuration and file layout enable the LFI-to-RCE chain. Sites using Biagiotti Core with PHP error logging enabled, or with predictable log file paths, face higher risk.

An unauthenticated remote attacker identifies a WordPress site running Biagiotti Core <= 2.1.1 and sends a crafted HTTP GET or POST request with a manipulated file path parameter targeting the vulnerable plugin endpoint. The PHP include function processes the attacker-controlled path, disclosing sensitive files such as wp-config.php containing database credentials. With server log access or predictable session file locations, the attacker can poison a log file with PHP code and then trigger its inclusion to achieve remote code execution on the web server.