---
id: "CVE-2026-112820"
kind: "vulnerability"
aliases: ["CVE-2026-112820"]
title: "Academist Core WordPress plugin: PHP file inclusion lets attackers load local files"
severity: "high"
cvss: 8.1
epss: 0.00438
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["academist-theme", "package", "php", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-22T11:17:31+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:05:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112820", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112820", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Academist Core WordPress plugin: PHP file inclusion lets attackers load local files

The academist-core plugin by Elated-Themes builds a PHP include or require path from input it does not control, enabling local file inclusion. Per the advisory an attacker can make the site load and read files from the server's disk, and the NVD rating is high (CVSS 8.1).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `academist-core` plugin is installed and its version in the WordPress admin under Plugins, or in `wp-content/plugins/academist-core/`
- Compare the installed version against the advisory's affected range (through 1.4.1)

## Fix

- Update the Academist Core plugin to a version newer than `1.4.1`, or remove it if unused
- The sources do not name a patched version: unknown

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112820
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112820

## From the sources

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_