CVE-2026-78562
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The Verdure Core plugin for WordPress up to version 1.2 is vulnerable to Local File Inclusion. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution when images and other 'safe' file types can be uploaded and included.
Risk Assessment
An attacker could execute arbitrary PHP code on the server, potentially leading to full site compromise, data theft, or further attacks.
Recommendation
Update the Verdure Core plugin to the latest version if available. Additionally, restrict file upload capabilities and apply the principle of least privilege.
Other vulnerabilities in Verdure Core
Original NVD description (English source)
The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.