Local File Inclusion in Tonda Core Plugin by WordPress
CVE-2026-65477

7.5HIGH

Key Information:

Vendor

WordPress
Status
Tonda Core
Vendor
CVE Published:
23 July 2026

What is CVE-2026-65477?

A local file inclusion vulnerability exists in the Tonda Core plugin for WordPress versions up to 2.1.2, which allows potential attackers to access sensitive files on the server. Exploiting this vulnerability could lead to unauthorized information disclosure or further attacks on the affected system, emphasizing the importance of regular plugin updates and security monitoring.

Affected Version(s)

Tonda Core <= 2.1.2

References

https://patchstack.com/database/wordpress/plugin/tonda-co...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
.