Struktur Core EUVD-2026-43419

Exploitation requires a low-privileged authenticated WordPress account (CVSS PR:L) on a site with the Struktur Core plugin (<= 2.5.1) installed and active, and the request must reach the specific plugin code path that builds an include/require filename from user input. The CVSS AC:H rating indicates non-trivial preconditions - success is not guaranteed on a single default request and likely depends on a particular parameter value, path encoding, or environmental state to bypass validation. Limiting factors: the authentication requirement (no anonymous exploitation), the elevated attack complexity, and the fact that pure LFI yields file disclosure rather than automatic code execution unless the server also exposes attacker-controllable includable content (log poisoning or file upload).

The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5) indicates network reach but high attack complexity and a requirement for low-level authentication (PR:L). No EPSS score was supplied, the CVE is not in CISA KEV, and no POC is referenced, so all signals point to a real but not urgent priority: exploitation requires a valid (likely contributor/subscriber-level) account plus specific conditions that raise complexity, arguing against opportunistic mass exploitation. There is internal tension in the input worth flagging: the tags and CWE description characterize this as Information Disclosure / LFI (a confidentiality issue), yet the CVSS vector claims full C:H/I:H/A:H - the high integrity/availability impact is only justified if the LFI reliably chains to PHP code execution, which the source data does not confirm. Treat the confidentiality (file read) impact as the confirmed risk and code execution as plausible-but-unverified.

An attacker who holds or obtains a low-privileged WordPress account on a site running Struktur Core <= 2.5.1 sends a crafted request that manipulates the filename fed to a PHP include, causing the application to disclose sensitive local files such as wp-config.php. Given AC:H, the attacker must satisfy additional conditions (e.g., a specific parameter state or path format) to succeed reliably; where server logs or uploaded content can be included, the read primitive may be escalated to PHP execution. No public POC is referenced in the available data.