CVE-2026-94062
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion. This issue affects Werkstatt: from n/a through 4.8.3.
Risk Assessment
An attacker may include local server files, potentially leading to sensitive data disclosure or code execution within the WordPress application context.
Recommendation
Update the Werkstatt plugin to a version newer than 4.8.3 or disable it if no fix is available.
Other vulnerabilities in Werkstatt
See all- CVE-2026-57690Medium
The Werkstatt plugin version 4.7.2 and earlier contains an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated administrator.
- CVE-2026-57689Medium
The Werkstatt plugin in versions 4.7.2 and earlier contains a broken access control vulnerability for subscribers. This allows users with the subscriber role to gain unauthorized access to functions or data.
- CVE-2026-27414High
The Werkstatt plugin for WordPress versions 4.8.3 and earlier contains a PHP Object Injection vulnerability via the contributor mechanism. This allows an attacker to inject malicious objects, potentially leading to remote code execution.
Original NVD description (English source)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS