CVE-2026-66671

HighCVSS 8.1

Published: 24/08/2026(UTC)Updated: 24/08/2026(UTC)Translated: 24/08/2026(UTC)NVD NIST

Summary

Unauthenticated Local File Inclusion in Verdure Core versions up to 1.2. Allows reading sensitive files from the server.

Risk Assessment

Risk of exposure of confidential data such as configuration files or user data.

Recommendation

Update Verdure Core to the latest version that includes the fix.

Other vulnerabilities in Verdure Core

CVE-2026-78562High
The Verdure Core plugin for WordPress up to version 1.2 is vulnerable to Local File Inclusion. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution when images and other 'safe' file types can be uploaded and included.

Original NVD description (English source)

Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS