PHP Remote File Inclusion Vulnerability in CMSMasters Content Composer
CVE-2026-25326

7.5HIGH

Key Information:

Vendor

WordPress
Status
Cmsmasters Content Composer
Vendor
CVE Published:
19 February 2026

What is CVE-2026-25326?

The CMSMasters Content Composer plugin contains a vulnerability that allows improper control of filenames in PHP's include/require statements. This flaw enables local file inclusion, potentially exposing sensitive files on the server. Users of versions up to 1.4.5 are particularly at risk, as attackers can exploit this weakness to gain unauthorized access to files. It highlights the importance of keeping plugins updated and implementing proper security measures to mitigate such vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

CMSMasters Content Composer <= n/a

References

https://patchstack.com/database/Wordpress/Plugin/cmsmaste...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
JSON
.