Local File Inclusion Vulnerability in Academist Core by Elated Themes
CVE-2026-112820

8.1HIGH

Key Information:

Vendor

WordPress
Status
Academist Core
Vendor
CVE Published:
22 October 2026

What is CVE-2026-112820?

A vulnerability has been identified in Academist Core by Elated Themes, allowing for PHP Local File Inclusion. This issue arises from improper handling of filename inputs in the PHP Include/Require statements, which could enable attackers to include local files. The vulnerability affects versions of the Academist Core plugin, specifically from n/a through 1.4.1. Ensuring your installation is updated is crucial for maintaining the security integrity of your application.

Affected Version(s)

Academist Core 0 <= 1.4.1

References

https://patchstack.com/database/wordpress/plugin/academis...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
.