Local File Inclusion in Mikado-Themes GrandPrix Core Product
CVE-2026-129091

8.1HIGH

Key Information:

Vendor

WordPress
Status
Grandprix Core
Vendor
CVE Published:
15 November 2026

What is CVE-2026-129091?

The Mikado-Themes GrandPrix Core product suffers from a Local File Inclusion vulnerability caused by improper control over filenames in PHP include or require statements. This vulnerability allows malicious actors to exploit the system, giving them the ability to include local files and potentially execute harmful scripts. Affected versions include all versions up to 1.0, which makes it crucial for users to update their installations to prevent unauthorized access and maintain web application security.

Affected Version(s)

GrandPrix Core 0 <= 1.0

References

https://patchstack.com/database/wordpress/plugin/grandpri...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
.