What is the CVSS score of EUVD-2026-37465?

EUVD-2026-37465 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Thegov Core are affected by EUVD-2026-37465?

The Thegov Core WordPress plugin, widely deployed on government and political websites, contains an unauthenticated remote file inclusion vulnerability (CVSS 8.1) that enables attackers to access…. A patch is available.

How to fix or mitigate EUVD-2026-37465?

Within 24 hours: Audit all WordPress instances to identify Thegov Core plugin deployments and current versions. Within 7 days: Update all affected Thegov Core installations to version 2.0.23 or later. Within 30 days: Verify patch deployment across all systems and conduct forensic review of access logs and file inclusion patterns from May 2026 forward to identify exploitation attempts.

Thegov Core EUVD-2026-37465

| CVE-2026-34893 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP WordPress Information Disclosure LFI Wordpress Plugin Thegov Core Webgeniuslab

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable and unauthenticated (AV:N/PR:N/UI:N); AC:H because exploitation needs a specific parameter and likely filter bypass; C:H for wp-config.php disclosure, I/A:L since RCE escalation depends on extra server conditions.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:43 vuln.today

Patch available

Jun 16, 2026 - 23:02 EUVD

DescriptionCVE.org

Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the Thegov Core WordPress plugin (versions prior to 2.0.23) allows remote attackers to coerce the application into including arbitrary files via a flaw classified as CWE-98 (PHP File Inclusion). Because the plugin powers the Thegov WordPress theme commonly used by government and political sites, successful exploitation can disclose sensitive configuration files such as wp-config.php and, depending on server state, escalate to PHP code execution. No public exploit identified at time of analysis, though Patchstack - the reporting party - has published a vendor advisory and a fixed release.

Technical ContextAI

The flaw sits in PHP include/require logic within the Thegov Core plugin (CPE cpe:2.3:a:webgeniuslab:thegov_core), distributed by WebGeniusLab as the companion plugin to the Thegov WordPress theme. CWE-98 covers cases where filename input passed to PHP's include, require, include_once, or require_once is not properly canonicalized or restricted to an allowlist, letting an attacker traverse the filesystem or, when wrappers like php://filter or remote streams are enabled, fold the LFI into source disclosure or remote code execution. Because the plugin exposes the vulnerable include path without an authentication check, the attack surface is reachable over standard HTTP(S) to any WordPress site running the plugin below 2.0.23.

RemediationAI

Upgrade the Thegov Core plugin to version 2.0.23 or later - this is the vendor-released patch referenced by the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/thegov-core/vulnerability/wordpress-thegov-core-plugin-2-0-23-local-file-inclusion-vulnerability). If immediate patching is not possible, deactivate the Thegov Core plugin (note: this will break Thegov theme features that depend on it, including custom post types and shortcodes) or place a WAF/ModSecurity rule in front of WordPress blocking requests with path-traversal sequences (../, %2e%2e/, php://filter) against plugin endpoints under /wp-content/plugins/thegov-core/ and the corresponding admin-ajax actions. As a hardening control, set PHP's open_basedir to the WordPress document root to contain LFI reads, and disable allow_url_include and the php:// wrapper in php.ini to neutralize the LFI-to-RCE pivot at the cost of breaking any plugin that legitimately uses stream wrappers.