What is the CVSS score of EUVD-2026-31802?

EUVD-2026-31802 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of SW Core are affected by EUVD-2026-31802?

The Magentech SW Core WordPress plugin (versions through 1.7.18) contains a local file inclusion vulnerability that could allow authenticated users to access sensitive server files and execute code.

How to fix or mitigate EUVD-2026-31802?

24 hours: identify and document all WordPress instances running Magentech SW Core plugin versions through 1.7.18. 7 days: disable the plugin if not business-critical, or if required, implement Web Application Firewall rules to block local file inclusion patterns and restrict administrative access. 30 days: establish monitoring for vendor security patch release and prepare upgrade plan once patch becomes available.

SW Core EUVD-2026-31802

| CVE-2026-39661 HIGH

PHP Remote File Inclusion (CWE-98)

2026-05-26 Patchstack

GHSA-v2hv-46cp-3vh7

PHP Information Disclosure LFI Sw Core

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:48 vuln.today

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magentech SW Core allows PHP Local File Inclusion.

This issue affects SW Core: from n/a through 1.7.18.

AnalysisAI

Local File Inclusion in Magentech SW Core WordPress plugin (versions through 1.7.18) allows authenticated remote attackers to coerce the application into including arbitrary PHP files via improperly validated filename input. Successful exploitation results in disclosure of sensitive server-side files and potential code execution under the web server context. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low at 0.11%.

Technical ContextAI

SW Core is a WordPress plugin distributed by Magentech, commonly bundled with commercial WooCommerce/Magentech themes to provide shared widgets and shortcodes. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement), where user-influenced input is concatenated into a PHP include/require call without adequate normalization or allow-listing. Although the CWE class is named 'PHP Remote File Inclusion', the vendor's own classification narrows the impact to Local File Inclusion, meaning attacker-controlled paths must resolve to files already present on the server (logs, uploads, /proc entries, session files) rather than remote URLs - typically because allow_url_include is disabled in modern PHP deployments.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied references; site operators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sw_core/vulnerability/wordpress-sw-core-plugin-1-7-18-local-file-inclusion-vulnerability) and the Magentech changelog for a version greater than 1.7.18 and upgrade immediately when published. As compensating controls until a fix ships, deactivate the SW Core plugin if the parent theme can function without it (some Magentech themes will lose widgets/shortcodes), restrict WordPress account self-registration and audit existing low-privilege accounts since exploitation requires PR:L, and deploy a WAF rule (Patchstack vPatch, Wordfence, ModSecurity) blocking traversal sequences (../, encoded %2e%2e, null bytes, php:// wrappers) on SW Core AJAX and admin-ajax endpoints - note that overly broad path-traversal rules can break legitimate plugin file selectors. Ensure php.ini has allow_url_include=Off and open_basedir scoped to the webroot to constrain post-inclusion impact.