CVE-2026-78562: Verdure Core WordPress Plugin RCE Vulnerability

CVE-2026-78562 Overview

The Verdure Core plugin for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 1.2. Unauthenticated attackers can include and execute arbitrary files on the server, resulting in execution of any PHP code contained in those files. Attackers can leverage this weakness to bypass access controls, access sensitive data, or achieve remote code execution when combined with an image upload or similar file upload primitive. The flaw is classified under CWE-98, improper control of filename for include/require statement in PHP.

Critical Impact
Unauthenticated remote attackers can execute arbitrary PHP code on vulnerable WordPress sites, leading to full site compromise.

Affected Products

Verdure Core plugin for WordPress, all versions up to and including 1.2
WordPress sites with the Verdure Core plugin installed and activated
Any hosting environment running the vulnerable plugin version

Discovery Timeline

2026-08-25 - CVE-2026-78562 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78562

Vulnerability Analysis

The Verdure Core plugin exposes a Local File Inclusion primitive that allows attacker-controlled input to reach a PHP include, require, or equivalent file-loading function. Because WordPress processes plugin code with the privileges of the web server, any PHP contained within an included file executes in the application context. Attackers do not need valid credentials to reach the vulnerable code path.

LFI in a PHP context routinely escalates to remote code execution when an attacker can place PHP content anywhere on the filesystem. Common escalation paths include uploading polyglot images, poisoning log files, abusing session files, or including files written by other plugins. Even without an upload primitive, LFI enables disclosure of configuration files such as wp-config.php, which contains database credentials and authentication secrets.

Root Cause

The root cause is improper validation and sanitization of a user-supplied parameter that is passed to a PHP file-inclusion function. The plugin does not restrict the input to an allowlist of expected filenames and does not strip directory traversal sequences such as ../ or null-byte terminators. This maps to CWE-98, PHP Remote File Inclusion.

Attack Vector

Exploitation occurs over the network against the WordPress HTTP interface. The attacker sends a crafted request containing a path parameter that references either a local file on disk or, depending on PHP configuration, a remote resource. No authentication or user interaction is required. The high attack complexity reflects the need for specific server-side conditions such as writable log paths or an available upload endpoint to achieve full code execution. Refer to the Wordfence Vulnerability Report and the Patchstack WordPress Vulnerability advisory for technical details.

Detection Methods for CVE-2026-78562

Indicators of Compromise

HTTP requests to WordPress endpoints containing directory traversal sequences such as ../, ..%2f, or URL-encoded null bytes in query parameters
Requests referencing sensitive local paths including wp-config.php, /etc/passwd, /proc/self/environ, or PHP session directories
Unexpected PHP execution originating from log files, upload directories, or session storage
New or modified PHP files inside the wp-content/uploads/ directory following inbound requests to the Verdure Core plugin

Detection Strategies

Inspect web server and WordPress access logs for parameter values containing path traversal patterns targeting Verdure Core endpoints
Correlate anomalous outbound network connections from the web server process with recent inbound requests to the plugin
Alert on PHP processes spawning shell interpreters such as sh, bash, or cmd.exe from the WordPress host
Deploy a web application firewall rule set that blocks LFI signatures targeting WordPress plugins

Monitoring Recommendations

Enable file integrity monitoring on wp-content/plugins/verdure-core/ and the WordPress core directories
Ingest WordPress, PHP-FPM, and web server logs into a centralized SIEM for query and retention
Track process lineage on WordPress servers to identify web-server-initiated command execution
Monitor for creation of new administrative users or modifications to wp_options and wp_users tables

How to Mitigate CVE-2026-78562

Immediate Actions Required

Identify all WordPress installations running the Verdure Core plugin and inventory installed versions
Deactivate and remove the Verdure Core plugin on sites where a patched version is not yet available
Restrict access to the WordPress site with an upstream web application firewall until remediation is complete
Rotate WordPress secret keys, database credentials, and administrator passwords if exploitation is suspected

Patch Information

At the time of publication, no fixed version is listed in the NVD entry for CVE-2026-78562. Consult the Patchstack WordPress Vulnerability advisory and the Wordfence Vulnerability Report for the latest vendor fix status and update to any release later than 1.2 as soon as one is published.

Workarounds

Disable the Verdure Core plugin until a patched release is available
Configure the web application firewall to block requests containing ../, ..%2f, and other traversal patterns targeting plugin endpoints
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to prevent remote file inclusion escalation
Restrict filesystem permissions so the web server user cannot read wp-config.php beyond what WordPress requires

bash

# Configuration example: disable remote inclusion primitives in php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = /var/www/html:/tmp