CVE-2026-66671: Verdure Core Path Traversal Vulnerability

CVE-2026-66671 Overview

CVE-2026-66671 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting the Verdure Core WordPress plugin in versions up to and including 1.2. The flaw is classified under CWE-98, Improper Control of Filename for Include/Require Statement in a PHP Program. Remote attackers can request the vulnerable endpoint without authentication and cause the application to include arbitrary files from the server. Successful exploitation exposes sensitive site data and can enable code execution when attacker-controlled content reaches an included path.

Critical Impact
An unauthenticated remote attacker can read local files and, under the right conditions, execute PHP code on the affected WordPress site.

Affected Products

Verdure Core WordPress plugin versions <= 1.2
WordPress sites running the vulnerable plugin
Hosting environments exposing PHP include paths through the plugin

Discovery Timeline

2026-08-24 - CVE-2026-66671 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-66671

Vulnerability Analysis

The Verdure Core plugin includes a PHP file whose path is derived from unvalidated user input. Because the include statement does not restrict the input to an allow-list of known files, attackers can traverse the filesystem and pull arbitrary local resources into the request. The advisory published by Patchstack confirms that no authentication is required to reach the vulnerable code path.

Exposed content typically includes WordPress configuration files such as wp-config.php, session data, and log files. Attackers who can influence log content or upload benign files can chain the LFI into PHP execution.

Root Cause

The root cause is improper control of a filename passed to a PHP include or require statement, tracked as [CWE-98]. Input taken from an HTTP request parameter is concatenated into an include path without sanitization or path normalization. The plugin fails to enforce a base directory or reject traversal sequences such as ../.

Attack Vector

Exploitation happens over the network. An attacker sends a crafted HTTP request to the vulnerable plugin endpoint with a manipulated file parameter pointing to a target path on the server. No credentials, tokens, or user interaction are required. The high attack complexity reflects conditions such as path prefix constraints or filter behavior that the attacker must overcome for reliable file inclusion.

See the Patchstack advisory for further technical detail.

Detection Methods for CVE-2026-66671

Indicators of Compromise

HTTP requests to Verdure Core plugin endpoints containing traversal patterns such as ../, ..%2f, or encoded null bytes
Access log entries referencing sensitive paths like wp-config.php, /etc/passwd, or /proc/self/environ
PHP error log entries showing failed include/require calls originating from Verdure Core files
Unexpected outbound requests or new PHP files created in the WordPress uploads directory after suspicious access

Detection Strategies

Inspect web server access logs for query parameters targeting Verdure Core with directory traversal sequences or absolute paths
Correlate WordPress plugin activity with file read events on sensitive server paths
Deploy a Web Application Firewall (WAF) rule set that flags LFI patterns against /wp-content/plugins/verdure-core/ URIs

Monitoring Recommendations

Alert on repeated 200-status responses to Verdure Core endpoints carrying suspicious file, page, or path parameters
Monitor integrity of wp-config.php and other high-value files for read access
Ingest WordPress, PHP-FPM, and web server logs into a centralized platform to correlate LFI attempts with post-exploitation activity

How to Mitigate CVE-2026-66671

Immediate Actions Required

Update Verdure Core to a version above 1.2 once the vendor releases a fixed build
Disable and remove the Verdure Core plugin if no patched release is available
Rotate WordPress secrets in wp-config.php and database credentials if LFI activity is observed
Restrict inbound access to /wp-content/plugins/verdure-core/ at the reverse proxy or WAF layer until patched

Patch Information

At publication, the Patchstack advisory is the authoritative reference. Administrators should verify vendor status directly and apply the fixed release as soon as it is published. In the interim, treat all versions <= 1.2 as vulnerable.

Workarounds

Block requests to Verdure Core endpoints containing traversal tokens (../, ..%2f, %00) using a WAF
Enforce open_basedir restrictions in PHP to constrain file inclusion to the WordPress document root
Set the WordPress uploads directory to disallow PHP execution via web server configuration
Remove the plugin from production hosts until a patched version is verified

bash

# Example nginx block to constrain Verdure Core requests and deny PHP execution in uploads
location ~* /wp-content/plugins/verdure-core/ {
    if ($args ~* "(\.\./|\.\.%2f|%00)") { return 403; }
}

location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}