CVE-2026-34895 Overview
CVE-2026-34895 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting the Softlab Core WordPress plugin in versions prior to 1.2.11. The flaw allows remote attackers to include and execute arbitrary local files on the underlying web server without prior authentication. The issue is categorized under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). Successful exploitation can lead to disclosure of sensitive configuration files, source code, and in some hosting configurations, remote code execution. The vulnerability was published on June 17, 2026 and tracked through the Patchstack Vulnerability Report.
Critical Impact
Unauthenticated attackers can include arbitrary files from the WordPress server, potentially leaking credentials in wp-config.php and enabling further compromise of the site.
Affected Products
- Softlab Core WordPress plugin versions prior to 1.2.11
- WordPress installations that have the Softlab Core plugin activated
- Sites running vulnerable plugin builds regardless of underlying theme
Discovery Timeline
- 2026-06-17 - CVE-2026-34895 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-34895
Vulnerability Analysis
The vulnerability resides in how Softlab Core handles user-controlled input that is passed into PHP file inclusion functions such as include, require, include_once, or require_once. Because the input is not sufficiently validated against an allow-list of permitted files, an attacker can supply a crafted path parameter and force the plugin to load files outside the intended directory. The endpoint is reachable without authentication, which removes the typical access barrier for LFI flaws in WordPress plugins. The Common Weakness Enumeration entry CWE-98 directly describes this class of PHP file inclusion flaw.
Root Cause
The root cause is improper neutralization of filename input used in a PHP include statement. The plugin trusts a request parameter and passes it to a file inclusion function without normalizing path traversal sequences (../), enforcing a base directory, or restricting extensions. This allows traversal to any readable file on the filesystem accessible to the PHP worker process.
Attack Vector
The attack vector is network-based and unauthenticated. An attacker sends a single HTTP request to the vulnerable plugin endpoint with a manipulated parameter value referencing a target file path. The high attack complexity reflected in the CVSS vector indicates the request must satisfy specific conditions, such as path encoding or matching expected suffix patterns. Targets include wp-config.php for database credentials, log files for log poisoning chains, and session storage that can be abused to escalate to code execution.
// No verified proof-of-concept code is available.
// Refer to the Patchstack advisory for technical detail:
// https://patchstack.com/database/wordpress/plugin/softlab-core/vulnerability/wordpress-softlab-core-plugin-1-2-11-local-file-inclusion-vulnerability
Detection Methods for CVE-2026-34895
Indicators of Compromise
- HTTP requests to Softlab Core plugin endpoints containing path traversal sequences such as ../, encoded variants like %2e%2e%2f, or null byte injection attempts.
- Web server access logs showing unauthenticated requests that reference sensitive paths such as wp-config.php, /etc/passwd, or PHP session files.
- Unexpected PHP include or require warnings in error logs referencing files outside the plugin directory.
Detection Strategies
- Inspect HTTP request parameters handled by Softlab Core for traversal patterns and reject requests containing unexpected file path tokens.
- Correlate web access logs with PHP error logs to flag inclusion of files outside the plugin's expected directory tree.
- Hunt for outbound connections or new file writes initiated by the www-data or PHP-FPM process immediately following anomalous plugin requests.
Monitoring Recommendations
- Enable verbose logging on the WordPress instance and forward web server and PHP logs to a centralized analytics platform for retention and correlation.
- Monitor file integrity on wp-config.php, plugin directories, and any uploads directory for unexpected reads or modifications.
- Alert on unauthenticated requests that produce HTTP 200 responses containing PHP code fragments or configuration content.
How to Mitigate CVE-2026-34895
Immediate Actions Required
- Upgrade the Softlab Core plugin to version 1.2.11 or later on every affected WordPress site.
- Audit web server access logs for prior exploitation attempts against the plugin's endpoints.
- Rotate any secrets stored in wp-config.php, including database credentials and authentication salts, if exposure is suspected.
Patch Information
The vendor addressed the issue in Softlab Core version 1.2.11. Administrators should apply the update through the WordPress plugin management interface or by deploying the updated plugin package. Confirmation and version metadata are documented in the Patchstack advisory.
Workarounds
- Deploy a Web Application Firewall rule that blocks requests to Softlab Core endpoints containing path traversal sequences or absolute paths.
- Restrict PHP open_basedir to the WordPress installation directory to limit which files the PHP process can read.
- Temporarily deactivate the Softlab Core plugin if patching cannot be performed immediately.
# Example php.ini hardening to constrain file inclusion scope
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
