WebFacing CVE-2026-84069

No authentication, user interaction, or non-default configuration is required: exploitation targets a bundled script that the plugin fails to access-restrict, and the plugin does not validate the user-supplied path before passing it to a local file include. The only prerequisite is that the target WordPress site runs the WebFacing plugin at a version before 5.4 with the vulnerable script reachable over HTTP. Realistic impact is bounded by what files the web-server user can read (e.g. wp-config.php); escalation to code execution additionally requires an includable attacker-controlled local file (log poisoning or an uploadable path), which is not guaranteed in every deployment.

The vendor/WPScan CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) describes an unauthenticated, network-reachable, low-complexity flaw with no user interaction - all signals that favor easy exploitation. Corroborating that, a public exploit exists (WPScan), a patch is available (5.4), and SSVC marks the flaw Automatable:yes with partial technical impact. However, the exploitation-probability signals are modest: EPSS is 0.31% (21st percentile), SSVC Exploitation is 'none' (no observed in-the-wild activity), and there is no CISA KEV listing. The most important caveat is that the confidentiality impact is likely UNDERSTATED: the description states the plugin uses an unvalidated user-supplied path to 'include a local file' (a PHP include-based Local File Inclusion). Unauthenticated LFI typically permits reading sensitive files such as wp-config.php (database credentials, auth salts) - which warrants C:H, not C:L - and PHP include() LFI can escalate to remote code execution via log poisoning or inclusion of attacker-controlled uploads, which would add I/A impact. Treat the 5.3 as a floor. Net: a genuinely exploitable, low-barrier bug whose real-world priority is tempered mainly by the plugin's small deployment footprint rather than by any technical difficulty.

A remote, unauthenticated attacker requests the unprotected bundled script directly and supplies a crafted path parameter (e.g. traversal sequences pointing at wp-config.php or /etc/passwd), causing the plugin to include and disclose the local file. A public exploit is available via WPScan, and because no authentication or user interaction is required, the request can be fully automated (SSVC Automatable:yes). If the attacker can plant PHP into an includable local file (log poisoning or an uploaded file), the same include primitive can be turned into code execution.