Academist Core
Monthly
Unauthenticated PHP local file inclusion in the Elated-Themes Academist Core plugin for WordPress (all versions through 1.4.1) lets a remote attacker steer an include/require statement toward files already present on the server, exposing their contents and, depending on what is included, influencing executed code - scored CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector requires no authentication and no user interaction, but AC:H reflects conditions the attacker does not fully control (such as a resolvable local path or a particular request state), which limits reliable or automated exploitation. Reported by Patchstack and prioritized as 'this_week'; no public exploit code or CISA KEV entry was identified at time of analysis, and the specific endpoint, parameter and feature that trigger the inclusion are not described in the available sources.
Unauthenticated PHP local file inclusion in the Elated-Themes Academist Core plugin for WordPress (all versions through 1.4.1) lets a remote attacker steer an include/require statement toward files already present on the server, exposing their contents and, depending on what is included, influencing executed code - scored CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector requires no authentication and no user interaction, but AC:H reflects conditions the attacker does not fully control (such as a resolvable local path or a particular request state), which limits reliable or automated exploitation. Reported by Patchstack and prioritized as 'this_week'; no public exploit code or CISA KEV entry was identified at time of analysis, and the specific endpoint, parameter and feature that trigger the inclusion are not described in the available sources.