Executive brief
SeedProd Pro, a popular WordPress plugin used for creating landing pages and maintenance mode screens, contains a security vulnerability that could allow an attacker to access sensitive server files. By exploiting this flaw, an authorized user with low-level permissions could potentially view internal configuration files, including database credentials. This could lead to a full compromise of the website's data and underlying infrastructure.
Technical details
A Local File Inclusion (LFI) vulnerability exists in SeedProd Pro versions prior to 6.19.5 due to improper validation of user-supplied input used in PHP include or require statements (CWE-98). An attacker with at least 'Contributor' level privileges can exploit this vulnerability over the network, though the attack complexity is rated as high. Successful exploitation allows the attacker to read sensitive local files on the server, such as wp-config.php, which may contain database credentials or other secrets. In some configurations, this could lead to remote code execution if the attacker can influence the contents of a file already present on the local filesystem. The issue is resolved in version 6.19.5.
Affected products
- SeedProd LLC SeedProd Pro before 6.19.5
Timeline
- 2025-10-24: other: Reported by João Pedro S Alcântara (Kinorth)
- 2026-05-27: patched: Patch released in version 6.19.5
- 2026-05-27: advisory: Published by Patchstack and NVD