/Vulnerability Library

Prodigy Commerce <= 3.3.0 - Local File Inclusion

CVE-2026-0926
Verified

Description

Prodigy Commerce WordPress plugin <= 3.2.9 contains a local file inclusion caused by improper sanitization of 'parameters[template_name]' parameter, letting unauthenticated attackers include and execute arbitrary files remotely.

Severity

Critical

CVSS Score

9.8

Exploit Probability

9%

Published Date

March 13, 2026

Template Author

shivam kamboj

CVE-2026-0926.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-0926
CWE ID:
cwe-98

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/prodigy-commerce/prodigy-commerce-329-unauthenticated-local-file-inclusion-via-parameterstemplate-namehttps://nvd.nist.gov/vuln/detail/CVE-2026-0926

Remediation Steps

Update to the latest version beyond 3.2.9.