Verdure Core CVE-2026-66671

The vulnerability requires no authentication (PR:N confirmed by CVSS vector) and no user interaction (UI:N), but attack complexity is rated High (AC:H), meaning exploitation is not straightforward against arbitrary targets and likely depends on specific server-side conditions such as particular PHP configuration settings, a writable log file accessible via the include path, or a non-default parameter state within the plugin. The Verdure Core plugin version must be 1.2 or earlier and actively installed and enabled on the WordPress site. Exploitation is limited by: (1) AC:H requiring conditions beyond attacker control, likely specific PHP environment settings or plugin configuration state; (2) the scope of readable files being bounded by PHP's open_basedir setting if configured; and (3) escalation to code execution requiring secondary conditions (log poisoning, PHP wrappers) not inherent to the base LFI primitive. Sites with restrictive open_basedir and disabled allow_url_include face materially reduced risk.

The NVD CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects an unauthenticated network-exploitable flaw with full CIA impact, but the AC:H (High Attack Complexity) metric is the critical moderating factor - exploitation is not trivial and likely requires specific server-side conditions or a multi-step chain. The I:H and A:H ratings appear to presuppose a complete LFI-to-RCE escalation chain rather than the base inclusion primitive; a conservative independent assessment would rate integrity and availability impact lower absent confirmed RCE capability. No EPSS score was provided in the intelligence data; without that signal, exploitation probability must be inferred from the AC:H and the absence of both KEV listing and published POC, suggesting real-world exploitation risk is currently below the CVSS headline would imply. The unauthenticated prerequisite (PR:N) does mean any scanning infrastructure can probe for the flaw at scale. Overall: treat as medium-high operational priority on WordPress sites running this plugin, not an emergency for unaffected deployments.

An unauthenticated attacker identifies a WordPress site running Verdure Core ≤ 1.2 via passive enumeration (e.g., plugin headers in source) and sends a crafted HTTP GET or POST request with a manipulated file-path parameter targeting a vulnerable inclusion point in the plugin. Under standard attack complexity conditions (AC:H), the attacker must meet a specific server or parameter condition - such as a particular request format or PHP configuration - to trigger successful file inclusion. If successful, the attacker reads wp-config.php to extract database credentials, or poisons an accessible log file with PHP code before including it to achieve remote code execution.