Executive brief
Softlab Core, a WordPress plugin used to support specific website themes, contains a security flaw that allows unauthorized users to access sensitive files on the server. An attacker could use this to steal database credentials or other configuration files, potentially leading to a full takeover of the website. This vulnerability is particularly dangerous because it does not require a login to exploit.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the Softlab Core plugin for WordPress due to improper control of filenames in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this by sending specially crafted requests to include and execute local files on the server. Successful exploitation can lead to the disclosure of sensitive information, such as wp-config.php, or potentially remote code execution if the attacker can upload or find a controllable file on the system. The vulnerability is fixed in version 1.2.11.
Affected products
- WebGeniusLab Softlab Core < 1.2.11
Timeline
- 2026-02-08: other: Vulnerability reported by researcher João Pedro S Alcântara (Kinorth)
- 2026-04-07: disclosed: Initial disclosure by Patchstack
- 2026-06-17: advisory: NVD publication date