{"id":"CVE-2026-112820","kind":"vulnerability","aliases":["CVE-2026-112820"],"related":[],"title":"Academist Core WordPress plugin: PHP file inclusion lets attackers load local files","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.","summary":"The academist-core plugin by Elated-Themes builds a PHP include or require path from input it does not control, enabling local file inclusion. Per the advisory an attacker can make the site load and read files from the server's disk, and the NVD rating is high (CVSS 8.1).","severity":"high","cvss":8.1,"epss":0.00438,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["academist-theme","package","php","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `academist-core` plugin is installed and its version in the WordPress admin under Plugins, or in `wp-content/plugins/academist-core/`\n- Compare the installed version against the advisory's affected range (through 1.4.1)","fix":"- Update the Academist Core plugin to a version newer than `1.4.1`, or remove it if unused\n- The sources do not name a patched version: unknown","status":"open","published_at":"2026-10-22T11:17:31+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:05:52+00:00","updated_at":"2026-10-25T03:05:52+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:05:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Academist Core plugin to a version newer than `1.4.1`, or remove it if unused\n- The sources do not name a patched version: unknown","reach":"internet","title":"Academist Core WordPress plugin: PHP file inclusion lets attackers load local files","impact":"medium","summary":"The academist-core plugin by Elated-Themes builds a PHP include or require path from input it does not control, enabling local file inclusion. Per the advisory an attacker can make the site load and read files from the server's disk, and the NVD rating is high (CVSS 8.1).","category":"package","nicknames":[],"who_cares":["wordpress","php","academist-theme"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads server files; secrets and config may leak","analyst_note":"Confirm the patched version and whether authentication is needed; check the NVD entry and the vendor changelog for academist-core.","how_to_check":"- Check whether the `academist-core` plugin is installed and its version in the WordPress admin under Plugins, or in `wp-content/plugins/academist-core/`\n- Compare the installed version against the advisory's affected range (through 1.4.1)","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Academist Core plugin (academist-core) through version 1.4.1, which is typically a WordPress site using the Academist theme family. Sites without this plugin installed are not affected. The sources do not say which configuration or role is required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000617,"input_tokens":3357,"output_tokens":563,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112820':15A,18A '-2026':14A,17A '1.4.1':113C '8.1':76B 'academist':1A,20B,27B,96C,99C,108C 'academist-cor':26B,98C 'academist-them':19B 'advisori':53B 'affect':107C 'allow':101C 'attack':9A,55B 'build':34B 'control':46B,78C 'core':2A,28B,97C,100C,109C 'cve':13A,16A 'cvss':75B 'disk':68B 'elat':32B,94C 'elated-them':31B,93C 'enabl':47B 'file':6A,12A,49B,63B,89C,104C 'filenam':80C 'high':74B 'improp':77C 'includ':37B 'include/require':82C 'inclus':7A,50B,90C 'inclusion.this':105C 'input':42B 'issu':106C 'let':8A 'load':10A,60B 'local':11A,48B,103C 'make':57B 'n/a':111C 'nvd':71B 'packag':22B 'path':40B 'per':51B 'php':5A,23B,36B,85C,87C,102C 'plugin':4A,29B 'program':86C 'rate':72B 'read':62B 'remot':88C 'requir':39B 'server':66B 'site':59B 'statement':83C 'theme':21B,33B,95C 'vulner':91C 'wordpress':3A,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Academist Core plugin (academist-core) through version 1.4.1, which is typically a WordPress site using the Academist theme family. Sites without this plugin installed are not affected. The sources do not say which configuration or role is required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112820","severity":null,"published_at":"2026-10-22T11:17:31+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112820","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112820","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}