CVE-2026-40721 Overview
CVE-2026-40721 is a Local File Inclusion (LFI) vulnerability affecting the Element Pack Pro WordPress plugin in versions up to and including 9.0.6. The flaw allows authenticated users with Contributor-level privileges to include and execute arbitrary local files on the WordPress server. The weakness is categorized under CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program. Successful exploitation can lead to disclosure of sensitive server files, execution of attacker-controlled content, and full compromise of the WordPress instance.
Critical Impact
A low-privileged Contributor account can include arbitrary local files, exposing credentials and potentially leading to remote code execution on the affected WordPress site.
Affected Products
- BdThemes Element Pack Pro plugin for WordPress
- Element Pack Pro versions through 9.0.6
- WordPress sites permitting Contributor-level registration or with compromised Contributor accounts
Discovery Timeline
- 2026-06-17 - CVE-2026-40721 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-40721
Vulnerability Analysis
The vulnerability resides in Element Pack Pro, a commercial WordPress plugin extending the Elementor page builder. A plugin component accepts user-controlled input that is passed to a PHP file inclusion construct without sufficient sanitization or allow-list validation. An attacker authenticated as a Contributor can manipulate the input to reference arbitrary files on the underlying filesystem.
Local File Inclusion against PHP applications often escalates beyond information disclosure. Attackers can read wp-config.php to recover database credentials and authentication keys. When log files, session files, or uploaded media can be poisoned with PHP code, LFI converts directly into remote code execution. The high attack complexity reflected in the scoring suggests specific preconditions are required, but the impact on confidentiality, integrity, and availability remains significant.
Root Cause
The root cause is improper control of a filename used in a PHP include, require, or equivalent statement [CWE-98]. The plugin trusts a request parameter or shortcode attribute to resolve a file path without enforcing a strict allow-list of permitted templates. Path traversal sequences or absolute paths are not stripped, enabling the inclusion of files outside the intended template directory.
Attack Vector
The attack vector is network-based and requires authentication as a Contributor. After logging in, the attacker submits a crafted request, such as a post containing a malicious shortcode or a direct call to an AJAX endpoint, that supplies an attacker-controlled file path. The PHP interpreter loads and evaluates the referenced file. Where attackers can stage their own content on disk through earlier upload primitives or log poisoning, this primitive yields code execution under the web server account. Technical specifics are documented in the Patchstack advisory.
Detection Methods for CVE-2026-40721
Indicators of Compromise
- Web server access logs containing path traversal sequences such as ../, ..%2f, or absolute filesystem paths in plugin parameters.
- Requests to Element Pack Pro endpoints or shortcodes referencing files like wp-config.php, /etc/passwd, or PHP session and log files.
- Unexpected outbound connections or new administrative users created shortly after suspicious Contributor activity.
- Newly added or modified PHP files within wp-content/uploads/ or plugin directories.
Detection Strategies
- Inspect WordPress request logs for plugin parameters whose values resolve to filesystem paths outside the expected template directory.
- Correlate Contributor account logins with subsequent post submissions or AJAX calls invoking Element Pack Pro handlers.
- Apply web application firewall rules that flag path traversal patterns and PHP wrapper schemes such as php://filter and file://.
Monitoring Recommendations
- Enable PHP open_basedir violation logging and forward those events to a centralized log platform.
- Monitor creation and modification of PHP files under wp-content/, particularly within uploads and plugin paths.
- Alert on Contributor accounts performing high volumes of post edits or AJAX requests in short windows.
How to Mitigate CVE-2026-40721
Immediate Actions Required
- Update Element Pack Pro to a release later than 9.0.6 once the vendor patch is available.
- Audit all WordPress user accounts and remove unused Contributor, Author, and Editor accounts.
- Reset database credentials and WordPress salts in wp-config.php if LFI activity is suspected.
- Restrict new user registration and require administrative approval for elevated roles.
Patch Information
Refer to the Patchstack vulnerability database entry for the BdThemes Element Pack Pro fixed version once released. Apply the vendor update through the WordPress plugin manager or by replacing the plugin files on disk.
Workarounds
- Deploy a WordPress-aware web application firewall with virtual patching rules targeting Element Pack Pro LFI patterns.
- Configure PHP open_basedir to constrain file inclusion to the WordPress document root and required temporary directories.
- Set disable_functions in php.ini to remove unneeded file and process primitives that aid post-exploitation.
- Temporarily deactivate Element Pack Pro on sites that allow untrusted Contributor accounts until the patch is applied.
# Example php.ini hardening to limit LFI blast radius
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off
expose_php = Off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
