CVE-2026-34893: Thegov Core Path Traversal Vulnerability

CVE-2026-34893 Overview

CVE-2026-34893 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting the Thegov Core WordPress plugin in versions prior to 2.0.23. The flaw is classified under CWE-98, improper control of filename for include/require statements in PHP. Remote attackers can reach the vulnerable code path without authentication and force the plugin to include local files from the underlying server. Successful exploitation can lead to disclosure of sensitive configuration data such as wp-config.php, and in some PHP environments can be chained into remote code execution.

Critical Impact
Unauthenticated attackers can read arbitrary local files and potentially execute PHP code in the context of the WordPress site.

Affected Products

WordPress plugin: Thegov Core
Affected versions: all releases prior to 2.0.23
Fixed version: Thegov Core 2.0.23

Discovery Timeline

2026-06-17 - CVE-2026-34893 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-34893

Vulnerability Analysis

The vulnerability sits in a PHP include path inside the Thegov Core plugin. The plugin accepts attacker-controlled input and passes it to a PHP include/require construct without sufficient validation or normalization. Because the issue is reachable pre-authentication, any unauthenticated network client that can reach the WordPress site can trigger the include. The attack vector is network-based, and the published CVSS vector reflects high impact across confidentiality, integrity, and availability. Attack complexity is rated high, which typically indicates the attacker must satisfy environmental conditions such as specific file paths, PHP configuration flags, or wrapper availability to fully weaponize the flaw. The EPSS probability reported at publication is approximately 0.42%.

Root Cause

The root cause is improper control of filename for include/require statements ([CWE-98]). User-supplied data influences the path argument passed to a PHP include directive. Path traversal sequences and absolute paths are not stripped, and the file extension is not constrained to a safe allowlist. As a result, the runtime resolves and executes whichever file the attacker references on the local filesystem.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable plugin endpoint with a parameter that points to a local file. The plugin then includes that file in PHP execution context. Attackers commonly target wp-config.php to recover database credentials and authentication keys. Where PHP filter wrappers such as php://filter are permitted, attackers can base64-encode arbitrary source files for exfiltration. Where log files, session files, or uploaded media can be poisoned with PHP content, the LFI can escalate to code execution. The vulnerability is exploitable without authentication or user interaction. Technical specifics are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-34893

Indicators of Compromise

HTTP requests to Thegov Core plugin endpoints containing path traversal patterns such as ../, ..%2f, or absolute paths like /etc/passwd.
Requests containing PHP stream wrappers, including php://filter, php://input, file://, or data://.
Web server access logs showing unauthenticated GET or POST traffic to plugin URIs under /wp-content/plugins/thegov-core/ with file-name parameters.
Unexpected reads of wp-config.php, .htaccess, or /proc/self/environ correlated with web worker processes.

Detection Strategies

Inspect web server and WAF logs for traversal sequences and wrapper schemes directed at Thegov Core parameters.
Alert on PHP include/require failures referencing non-plugin paths in application or PHP error logs.
Correlate file read activity from the web server user against sensitive WordPress files using endpoint telemetry.

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized analytics platform with retention sufficient for incident review.
Monitor outbound connections from the web host that follow suspicious LFI requests, which can indicate post-exploitation staging.
Track plugin version inventory across WordPress sites and alert when Thegov Core is below 2.0.23.

How to Mitigate CVE-2026-34893

Immediate Actions Required

Upgrade Thegov Core to version 2.0.23 or later on all WordPress installations.
Audit web and PHP logs for prior exploitation indicators dating back to the plugin's installation.
Rotate WordPress secrets in wp-config.php and database credentials if file disclosure cannot be ruled out.

Patch Information

The vendor addressed the issue in Thegov Core 2.0.23. Administrators should update through the WordPress plugin manager or by replacing the plugin files with the fixed release. Refer to the Patchstack Vulnerability Report for vendor-confirmed remediation details.

Workarounds

Deploy a WAF rule that blocks traversal sequences and PHP stream wrappers in request parameters targeting /wp-content/plugins/thegov-core/.
Disable the plugin until the patched version can be deployed.
Harden PHP by setting allow_url_include=Off and restricting open_basedir to the WordPress document root.

bash

# Example PHP hardening in php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Example WAF rule (ModSecurity) blocking traversal on the plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/thegov-core/" \
    "chain,id:1026034893,phase:2,deny,status:403,msg:'Thegov Core LFI attempt'"
    SecRule ARGS "@rx (\.\./|php://|file://|data://)" "t:lowercase,t:urlDecodeUni"