CVE-2026-48972: WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability

Synopsis

This is a PHP Local File Inclusion vulnerability in the SeedProd Pro WordPress plugin affecting versions before 6.19.5. An authenticated attacker with a low-privilege account can reach the vulnerable code over the network, and under the right conditions, force the server to include and execute arbitrary PHP files from the local filesystem. Successful exploitation gives the attacker full read, write, and availability impact on the affected host. A patched-image rebuild at version 6.19.5 is available on HarborGuard for environments running an affected version of SeedProd Pro.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the service via HTTP or HTTPS.

• AuthenticationRequired

  Any low-privilege WordPress account is sufficient; no administrative access is needed.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; exploitation is direct.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must satisfy specific conditions such as particular server configuration or file layout before the inclusion can be triggered reliably.

Blast Radius

• Reads arbitrary files from the server filesystem, including WordPress configuration files containing database credentials and secret keys.
• Executes attacker-controlled PHP logic by including a crafted local file, enabling full remote code execution on the host.
• Modifies application data or writes files to the filesystem if the web server process has write permissions.
• Crashes or destabilizes the affected service by including a malformed or resource-exhausting file.