CVE-2026-34894: WordPress Integrio Core plugin < 1.2.8 - Local File Inclusion vulnerability

Synopsis

Local File Inclusion (LFI) is an unauthenticated vulnerability in the Integrio Core WordPress plugin by WebGeniusLab affecting versions before 1.2.8. The flaw is reachable over the network and requires no credentials, though exploitation involves conditions that raise its complexity. A successful attacker can read arbitrary files from the server, tamper with application data, and disrupt service availability. A patched-image rebuild at version 1.2.8 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session token is needed; the vulnerable code path is accessible to unauthenticated requests.

• Victim interactionNot required

  The attacker does not need to involve a user or administrator to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is rated High, meaning the exploit depends on specific conditions such as file path guessing or particular server configurations that the attacker cannot fully control.

Blast Radius

• An attacker can read arbitrary files from the server filesystem, including WordPress configuration files that contain database credentials and secret keys.
• An attacker can tamper with application data or inject content by including writable files, potentially leading to code execution depending on server configuration.
• The integrity of the WordPress installation can be undermined, allowing persistent modification of site behavior or content.
• Service availability can be disrupted by including files that trigger fatal errors or exhaust server resources.