# CVE-2026-54845: PluginUs.Net MDTF unauthenticated local file inclusion

Source: https://junglewise.ai/threats/cve-2026-54845-pluginus-net-mdtf-unauthenticated-local-file-inclusion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-54845 · Severity: high · CVSS 8.1 · Published 2026-06-25

The MDTF (WP Meta Data Filter and Taxonomy Filter) plugin for WordPress is vulnerable to a security flaw that allows unauthorized users to access sensitive files on the server. By exploiting this vulnerability, an attacker could view internal configuration files, such as those containing database credentials, potentially leading to a full site takeover. This issue affects websites using version 1.3.8 or older of the plugin.

Vendors: [PluginUs.Net](https://junglewise.ai/threats/vendors/pluginus-net).

## Quick answers

**Is CVE-2026-54845 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54845 being exploited in the wild.

**How severe is CVE-2026-54845?** High severity, with a CVSS score of 8.1, published 25 June 2026.

**Which products and versions are affected?** PluginUs.Net Meta Data Filter and Taxonomy Filter <= 1.3.8.

**Is there a fix for CVE-2026-54845?** A patch was published on 2026-06-25: Version 1.3.9 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54845 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54845?** Check whether you run PluginUs.Net Meta Data Filter and Taxonomy Filter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MDTF (WP Meta Data Filter and Taxonomy Filter) plugin for WordPress is vulnerable to Local File Inclusion (LFI) in versions up to and including 1.3.8. The vulnerability stems from improper control of filenames used in PHP include or require statements (CWE-98), allowing an unauthenticated attacker to specify local files for execution or disclosure. While the attack vector is network-based and requires no privileges, the CVSS assessment indicates high complexity, likely due to specific configuration requirements or input filtering that must be bypassed. Successful exploitation can lead to the exposure of sensitive system files or remote code execution if the attacker can upload or influence the content of a local file. A fix is available in version 1.3.9.

## Affected products

- PluginUs.Net MDTF (WP Meta Data Filter and Taxonomy Filter) <= 1.3.8

## Timeline

- 2026-06-02: other: Reported by Ossacip Thanh
- 2026-06-18: advisory: Patchstack advisory published
- 2026-06-25: disclosed: NVD publication date
- 2026-06-25: patched: Version 1.3.9 released to address the vulnerability

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-plugin-1-3-8-local-file-inclusion-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-plugin-1-3-8-local-file-inclusion-vulnerability?_s_id=cve)