Live › vulnerability › CVE-2026-112820
Go to dashboardThe academist-core plugin by Elated-Themes builds a PHP include or require path from input it does not control, enabling local file inclusion. Per the advisory an attacker can make the site load and read files from the server's disk, and the NVD rating is high (CVSS 8.1).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Academist Core plugin (academist-core) through version 1.4.1, which is typically a WordPress site using the Academist theme family. Sites without this plugin installed are not affected. The sources do not say which configuration or role is required.
No product ranges from the sources yet.
academist-core plugin is installed and its version in the WordPress admin under Plugins, or in wp-content/plugins/academist-core/1.4.1, or remove it if unusedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-112820")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.