Local File Inclusion Vulnerability in WebFacing™ Plugin for WordPress
CVE-2026-84069

Currently unrated

Key Information:

Vendor

WordPress
Status
Webfacing™
Vendor
CVE Published:
27 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-84069?

The WebFacing™ WordPress plugin prior to version 5.4 is susceptible to a security flaw that allows unauthenticated users to exploit the system via Local File Inclusion. This vulnerability arises from insufficient access restrictions on a bundled script and a failure to validate user-supplied paths, potentially leading to unauthorized access to sensitive files on the server.

Affected Version(s)

WebFacing™ 5.3 < 5.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-84069 - Proof of Concept

References

https://wpscan.com/vulnerability/04965370-b4f4-4629-a9b1-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

nobody
WPScan
.