EIP-2026-113494

PRE-CVE

WordPress Core 2.0 < 2.7.1 - 'admin.php' Module Configuration Security Bypass

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-113494. PoCs published by Fernando Arnaboldi.

AI-analyzed exploit summary The exploit demonstrates a Local File Inclusion (LFI) vulnerability in WordPress via the 'page' parameter in admin.php, allowing unauthorized access to sensitive files. The provided URIs show examples of paths that can be manipulated to read arbitrary files.

Description

WordPress Core 2.0 < 2.7.1 - 'admin.php' Module Configuration Security Bypass

Exploits (1)

exploitdb WORKING POC VERIFIED
by Fernando Arnaboldi · textwebappsphp
https://www.exploit-db.com/exploits/10088

The exploit demonstrates a Local File Inclusion (LFI) vulnerability in WordPress via the 'page' parameter in admin.php, allowing unauthorized access to sensitive files. The provided URIs show examples of paths that can be manipulated to read arbitrary files.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: WordPress (version not specified)
Auth required
Prerequisites: Access to WordPress admin interface · Valid session or authentication credentials
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026