🔐 CVE Alert

CVE-2026-0926

CRITICAL 9.8

Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]

CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th

The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arbitrary files or execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

CWE CWE-98
Vendor prodigycommerce
Product prodigy commerce
Published Feb 19, 2026
Last Updated Apr 8, 2026
Stay Ahead of the Next One

Get instant alerts for prodigycommerce prodigy commerce

Be the first to know when new critical vulnerabilities affecting prodigycommerce prodigy commerce are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

prodigycommerce / Prodigy Commerce
0 ≤ 3.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/de255530-6b2d-426b-9f80-dbfebd2e3307?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/frontend/shortcodes/class-prodigy-short-code-my-account.php#L69 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/frontend/class-prodigy-public.php#L491 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/helpers/class-prodigy-template.php#L55 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/prodigy-commerce/tags/3.2.9/includes/helpers/class-prodigy-template.php#L55 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3464655/

Credits

Athiwat Tiprasaharn Itthidej Aramsri Waris Damkham