What is the CVSS score of CVE-2026-7522?

CVE-2026-7522 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Advanced Database Cleaner are affected by CVE-2026-7522?

The Advanced Database Cleaner - Premium WordPress plugin (versions ≤4.1.0) contains a local file inclusion vulnerability (CVSS 8.8) requiring authenticated subscriber-level access that enables…

How to fix or mitigate CVE-2026-7522?

24 hours: Inventory all WordPress instances using Advanced Database Cleaner - Premium version 4.1.0 and earlier; immediately restrict plugin access to administrator role only via WordPress capabilities. 7 days: Deactivate and uninstall the plugin from all production and staging environments; identify and deploy alternative database management tools for required functionality. 30 days: Conduct comprehensive audit across all WordPress infrastructure to confirm complete plugin removal; validate no residual files or deprecated installations remain.

Advanced Database Cleaner CVE-2026-7522

EUVD-2026-31062 HIGH

PHP Remote File Inclusion (CWE-98)

2026-05-20 Wordfence

GHSA-pqm5-qrxr-hh22

LFI Information Disclosure RCE WordPress PHP

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 05:15 vuln.today

DescriptionCVE.org

The Advanced Database Cleaner - Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.1.0 via the 'template' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

AnalysisAI

Local File Inclusion in the Advanced Database Cleaner - Premium WordPress plugin (versions up to and including 4.1.0) allows Subscriber-level authenticated users to include and execute arbitrary .php files via the 'template' parameter. The flaw, reported by Wordfence, carries a CVSS score of 8.8 and can be escalated to full remote code execution when combined with a file upload primitive, while no public exploit identified at time of analysis.

Technical ContextAI

The Advanced Database Cleaner - Premium plugin from sigmaplugin (CPE cpe:2.3:a:sigmaplugin:advanced_database_cleaner_-_premium) is a commercial WordPress add-on used to clean orphaned database entries, optimize tables, and schedule maintenance tasks. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where the 'template' request parameter is passed into a PHP include/require construct without adequate path normalization or allowlisting. Because PHP's include family executes any .php file resolved on disk, an attacker controlling the path can pivot a file-read primitive into code execution by referencing previously uploaded PHP content or attacker-controlled paths reachable from the WordPress installation.

RemediationAI

No vendor-released patch version is independently confirmed from the available data, so administrators should consult the sigmaplugin changelog at https://docs.sigmaplugin.com/article/97-advanced-database-cleaner-chaneglog and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/77e4e516-8a12-48ee-9124-27f941b68b13?source=cve to obtain and install a version newer than 4.1.0 once published. Until then, disable or uninstall the Advanced Database Cleaner - Premium plugin (the safest mitigation; database cleanup features will be lost), or close the attack path by disabling WordPress new-user registration and removing existing Subscriber-or-above accounts that are not strictly required (side effect: blocks any open-registration workflow). As an additional layer, deploy a WAF rule that filters the 'template' parameter for path traversal sequences and disallowed extensions, restrict write permissions on wp-content/uploads so PHP files cannot be placed there, and ensure the web server is configured to refuse PHP execution from uploads directories - recognizing that WAF rules may produce false positives on legitimate template names.