CVE-2026-0926
CRITICAL NUCLEIProdigy Commerce WordPress Plugin <3.2.9 - LFI
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-0926. PoCs published by Diamorphine, diamorphine666, Sechunt3r. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Prodigy Commerce WordPress plugin <= 3.2.9 by manipulating the 'parameters[template_name]' parameter in an AJAX request. It retrieves a nonce from the target site and uses it to include arbitrary files, such as /etc/passwd, via the admin-ajax.php endpoint.
Description
The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arbitrary files or execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Exploits (3)
This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Prodigy Commerce WordPress plugin <= 3.2.9 by manipulating the 'parameters[template_name]' parameter in an AJAX request. It retrieves a nonce from the target site and uses it to include arbitrary files, such as /etc/passwd, via the admin-ajax.php endpoint.
This Python script exploits a local file inclusion vulnerability in Prodigy Commerce WordPress plugin <= 3.2.9 by sending a crafted POST request to admin-ajax.php with an unsanitized 'parameters[template_name]' parameter. It retrieves a nonce from the target site and uses it to read arbitrary files (default: /etc/passwd).
This repository contains a functional exploit for CVE-2026-0926, an unauthenticated Local File Inclusion (LFI) vulnerability in Prodigy Commerce WordPress plugin <= 3.3.0. The exploit uses a two-step process: extracting a nonce from the frontend and then sending a crafted AJAX request to include arbitrary files via the 'parameters[template_name]' parameter.
Nuclei Templates (1)
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H