{"id":"CVE-2026-125795","kind":"vulnerability","aliases":["CVE-2026-125795"],"related":[],"title":"Estatik WordPress plugin: PHP file inclusion flaw lets attackers run server files","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through 4.3.6.","summary":"The Estatik plugin for WordPress includes a file path taken without proper checks, so an attacker can make PHP load local files. Depending on the server setup, this can expose secrets or run attacker-controlled code.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["estatik","package","php","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Estatik plugin version in the WordPress admin plugins list or `wp plugin get estatik --field=version`\n- Compare the version against the range `4.3.6` and earlier","fix":"- Estatik: move to a version newer than `4.3.6`, as the affected range ends there; the exact fixed release is unknown from the sources","status":"open","published_at":"2026-11-15T15:16:47+00:00","first_seen_at":"2026-11-15T15:36:07+00:00","triaged_at":"2026-11-15T15:37:10+00:00","updated_at":"2026-11-15T15:37:10+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-15T15:37:10Z","model":"claude-haiku-5-5","output":{"fix":"- Estatik: move to a version newer than `4.3.6`, as the affected range ends there; the exact fixed release is unknown from the sources","reach":"internet","title":"Estatik WordPress plugin: PHP file inclusion flaw lets attackers run server files","impact":"high","summary":"The Estatik plugin for WordPress includes a file path taken without proper checks, so an attacker can make PHP load local files. Depending on the server setup, this can expose secrets or run attacker-controlled code.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","estatik","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Server files readable, possibly code runs on the server","analyst_note":"Confirm the fixed Estatik version and whether the flaw needs authentication, using the NVD entry and the plugin's changelog.","how_to_check":"- Check the installed Estatik plugin version in the WordPress admin plugins list or `wp plugin get estatik --field=version`\n- Compare the version against the range `4.3.6` and earlier\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Estatik real estate plugin for WordPress at version 4.3.6 or earlier are exposed. The sources do not state which plugin settings or user roles are needed to reach the flawed include path, so the exact trigger conditions are unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000742,"input_tokens":4548,"output_tokens":575,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-125795':15A,18A '-2026':14A,17A '4.3.6':90C 'affect':85C 'allow':79C 'attack':9A,38B,57B 'attacker-control':56B 'check':35B 'code':59B 'control':58B,61C 'cve':13A,16A 'depend':45B 'estatik':1A,19B,24B,76C,77C,78C,86C 'expos':52B 'file':5A,12A,30B,44B,72C,82C 'filenam':63C 'flaw':7A 'improp':60C 'includ':28B 'include/require':65C 'inclus':6A,73C 'inclusion.this':83C 'issu':84C 'let':8A 'load':42B 'local':43B,81C 'make':40B 'n/a':88C 'packag':20B 'path':31B 'php':4A,21B,41B,68C,70C,80C 'plugin':3A,25B 'program':69C 'proper':34B 'remot':71C 'run':10A,55B 'secret':53B 'server':11A,48B 'setup':49B 'statement':66C 'taken':32B 'vulner':74C 'without':33B 'wordpress':2A,22B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Estatik real estate plugin for WordPress at version 4.3.6 or earlier are exposed. The sources do not state which plugin settings or user roles are needed to reach the flawed include path, so the exact trigger conditions are unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","estatik","package","php","wordpress"],"campaign_type":null,"search_a":"'-125795':15A,18A '-2026':14A,17A 'attack':9A 'cve':13A,16A 'estatik':1A 'file':5A,12A 'flaw':7A 'inclus':6A 'let':8A 'php':4A 'plugin':3A 'run':10A 'server':11A 'wordpress':2A","search_b":"'attack':38B,57B 'attacker-control':56B 'check':35B 'code':59B 'control':58B 'depend':45B 'estatik':19B,24B 'expos':52B 'file':30B,44B 'includ':28B 'load':42B 'local':43B 'make':40B 'packag':20B 'path':31B 'php':21B,41B 'plugin':25B 'proper':34B 'run':55B 'secret':53B 'server':48B 'setup':49B 'taken':32B 'without':33B 'wordpress':22B,27B","search_c":"'4.3.6':90C 'affect':85C 'allow':79C 'control':61C 'estatik':76C,77C,78C,86C 'file':72C,82C 'filenam':63C 'improp':60C 'include/require':65C 'inclus':73C 'inclusion.this':83C 'issu':84C 'local':81C 'n/a':88C 'php':68C,70C,80C 'program':69C 'remot':71C 'statement':66C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T15:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125795","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125795","severity":null,"published_at":"2026-11-15T15:16:47+00:00","modified_at":"2026-11-15T15:16:47+00:00","first_seen_at":"2026-11-15T15:36:07+00:00","fetched_at":"2026-11-15T15:36:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}