CVE-2026-0926

The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arbitrary files or execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

• CWE-98

• https://plugins.trac.wordpress.org/browser/prodigy-commerce/tags/3.2.9/includes/helpers/class-prodigy-template.php#L55
• https://plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/frontend/class-prodigy-public.php#L491
• https://plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/frontend/shortcodes/class-prodigy-short-code-my-account.php#L69
• https://plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/helpers/class-prodigy-template.php#L55
• https://plugins.trac.wordpress.org/changeset/3464655/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/de255530-6b2d-426b-9f80-dbfebd2e3307?source=cve

Published

Feb 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-0918The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP servic…7.5
• CVE-2026-0919The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 camer…7.5
• CVE-2026-0920The LA-Studio Element Kit for Elementor plugin for WordPress…9.8
• CVE-2026-0921Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-0924BuhoCleaner contains an insecure XPC service that allows loc…7
• CVE-2026-0925Tanium addressed an improper input validation vulnerability …4.9
• CVE-2026-0927The KiviCare – Clinic & Patient Management System (EHR) plug…5.3
• CVE-2026-0929The RegistrationMagic WordPress plugin before 6.0.7.2 does …4.3
• CVE-2026-0930Potential read out of bounds case with wolfSSHd on Windows w…4.3
• CVE-2026-0931Denial-of-service vulnerability in M-Files Server versions b…6.9
• CVE-2026-0932Blind server-side request forgery (SSRF) vulnerability in le…7.3
• CVE-2026-0933SummaryA command injection vulnerability (CWE-78) has been f…9.9