What is the CVSS score of EUVD-2026-37467?

EUVD-2026-37467 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Softlab Core are affected by EUVD-2026-37467?

The Softlab Core WordPress plugin (versions before 1.2.11) contains an unauthenticated remote file inclusion vulnerability that allows attackers to read sensitive files or potentially execute…. A patch is available.

How to fix or mitigate EUVD-2026-37467?

Within 24 hours: Identify all WordPress installations with Softlab Core plugin installed and document their current versions. Within 7 days: Update Softlab Core to version 1.2.11 or later across all affected WordPress deployments. Within 30 days: Audit access logs for suspicious file access patterns and conduct post-patch vulnerability verification.

Softlab Core EUVD-2026-37467

| CVE-2026-34895 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Softlab Core

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N) with a non-default precondition (AC:H); confidentiality high from arbitrary file read, but I/A only low absent a confirmed RCE chain.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:42 vuln.today

Patch available

Jun 16, 2026 - 23:02 EUVD

DescriptionCVE.org

Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions.

AnalysisAI

Unauthenticated local file inclusion in Softlab Core WordPress plugin versions before 1.2.11 allows remote attackers to read or include arbitrary local files on the server, potentially leading to sensitive information disclosure or remote code execution if attacker-controlled content can be reached. The flaw is reported by Patchstack and tagged as PHP/LFI affecting the WebGeniusLab Softlab Core plugin used in WordPress deployments. No public exploit identified at time of analysis, though the unauthenticated nature and high CVSS impact warrant prompt patching.

Technical ContextAI

Softlab Core is a WordPress plugin maintained by WebGeniusLab (CPE cpe:2.3:a:webgeniuslab:softlab_core), commonly bundled with Softlab and related WordPress themes to provide shortcodes and core helper functionality. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program, aka PHP Remote File Inclusion / Local File Inclusion), meaning untrusted input flows into a PHP include/require statement without sufficient validation. In a WordPress context this typically manifests as an AJAX action, REST endpoint, or shortcode handler that accepts a file path or template name parameter and passes it to include/require, enabling directory traversal and inclusion of arbitrary local PHP/configuration files such as wp-config.php.

RemediationAI

Vendor-released patch: upgrade Softlab Core to version 1.2.11 or later via the WordPress plugin updater or by replacing the plugin directory with the fixed release referenced in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/softlab-core/vulnerability/wordpress-softlab-core-plugin-1-2-11-local-file-inclusion-vulnerability). If immediate patching is not possible, deactivate the Softlab Core plugin (this will break Softlab/WebGeniusLab theme features that depend on it), or place a WAF/ModSecurity rule in front of WordPress that blocks requests to the plugin's AJAX/REST endpoints containing path traversal sequences (../, encoded variants, null bytes) or absolute filesystem paths - accepting the trade-off that overly broad rules may break legitimate template loading. Additionally harden PHP with open_basedir restricted to the WordPress document root and ensure allow_url_include is Off to limit blast radius of any residual include flaws.