CVE-2026-125795 · Package
NO FIX YET · SEE WHAT TO DO
The Estatik plugin for WordPress includes a file path taken without proper checks, so an attacker can make PHP load local files. Depending on the server setup, this can expose secrets or run attacker-controlled code.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Estatik real estate plugin for WordPress at version 4.3.6 or earlier are exposed. The sources do not state which plugin settings or user roles are needed to reach the flawed include path, so the exact trigger conditions are unknown.
Not affected if plugin-not-installed
Who cares estatik, php, wordpress
wp plugin get estatik --field=version4.3.6 and earlier4.3.6, as the affected range ends there; the exact fixed release is unknown from the sourcesImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through 4.3.6.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.