CVE-2026-34895: WordPress Softlab Core plugin < 1.2.11 - Local File Inclusion vulnerability

Synopsis

Local File Inclusion (LFI) is a class of vulnerability where an attacker tricks an application into reading arbitrary files from the server's filesystem by supplying a crafted file path in a request. This vulnerability affects the Softlab Core WordPress plugin by WebGeniusLab in versions below 1.2.11, and is reachable over the network with no authentication required. Successful exploitation gives an attacker full read access to files on the server, the ability to tamper with data, and can disrupt service availability; in many WordPress environments LFI can be chained to achieve remote code execution. A patched-image rebuild at version 1.2.11 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the WordPress installation to exploit this vulnerability.

• AuthenticationNot required

  No account or session token is needed; the vulnerability is exploitable by any unauthenticated HTTP request.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the server without any social-engineering step.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker may need to satisfy specific environmental conditions, timing constraints, or craft a precise payload to reliably trigger the file inclusion.

Blast Radius

• A successful attacker can read arbitrary files from the server filesystem, including WordPress configuration files that contain database credentials and secret keys.
• With write-capable file paths or log-poisoning techniques, the attacker can modify server-side content or inject executable code, compromising the integrity of the application.
• Full confidentiality, integrity, and availability impact is rated High, meaning the attacker can crash or render the WordPress service unavailable alongside data theft and tampering.
• In shared-hosting or containerized environments, file disclosure can expose secrets that grant lateral access to adjacent services or databases.