Unauthenticated Local File Inclusion in MDTF by WordPress
CVE-2026-54845

8.1HIGH

Key Information:

Vendor

WordPress
Status
Mdtf
Vendor
CVE Published:
25 June 2026

What is CVE-2026-54845?

The MDTF plugin versions up to 1.3.8 for WordPress are susceptible to a Local File Inclusion vulnerability that allows attackers to exploit unauthenticated access, potentially exposing sensitive information or executing arbitrary files on the server. This flaw emphasizes the necessity of implementing strict validation mechanisms to safeguard system integrity and protect user data.

Affected Version(s)

MDTF <= 1.3.8

References

https://patchstack.com/database/wordpress/plugin/wp-meta-...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ossacip Thanh | Patchstack Bug Bounty Program
.