CVE-2026-34893: WordPress Thegov Core plugin < 2.0.23 - Local File Inclusion vulnerability

Synopsis

Local File Inclusion (LFI) is a vulnerability in the Thegov Core WordPress plugin by WebGeniusLab affecting all versions below 2.0.23. The flaw is reachable over the network without any authentication, though successful exploitation requires overcoming high-complexity conditions such as specific server configurations or environmental factors. A successful attack gives the attacker full read access to files on the server, the ability to modify data, and can crash or fully compromise the affected service. A patched-image rebuild at version 2.0.23 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress service via HTTP or HTTPS.

• AuthenticationNot required

  No account or session token is needed; the vulnerable code path is accessible to any anonymous request.

• Victim interactionNot required

  Exploitation is entirely attacker-driven and does not require any action from a site administrator or user.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must account for specific server-side conditions such as particular PHP configurations, file path constraints, or other environmental factors that are not guaranteed to be present.

Blast Radius

• Reads arbitrary files from the server filesystem, including WordPress configuration files that contain database credentials and secret keys.
• Modifies or overwrites server-side data if the included file can be chained to a write primitive, compromising data integrity.
• Crashes the web server process or the PHP runtime by forcing inclusion of binary or malformed files, causing a service outage.