CVE-2026-0926

🗓️ 19 Feb 2026 04:36:24Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 64 Views🌐 WEB

Unauthenticated local file inclusion in Prodigy Commerce plugin up to 3.2.9 via template_name.

Reporter	Title	Published	Views	Family All 16
GithubExploit	exploit-arsenal	23 Jun 202608:55	–	githubexploit
GithubExploit	Exploit for CVE-2026-0926	23 May 202621:29	–	githubexploit
GithubExploit	Exploit for CVE-2026-0926	23 May 202621:29	–	githubexploit
Circl	CVE-2026-0926	19 Feb 202606:00	–	circl
CNNVD	WordPress plugin Prodigy Commerce 安全漏洞	19 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-0926 Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]	19 Feb 202604:36	–	cvelist
Exploit DB	Prodigy Commerce 3.3.0 - Local File Inclusion	29 May 202600:00	–	exploitdb
Kitploit	CVE-2026-0926-exploit	10 Sep 202609:56	–	kitploit
Nuclei	Prodigy Commerce <= 3.3.0 - Local File Inclusion	10 Sep 202604:50	–	nuclei
NVD	CVE-2026-0926	19 Feb 202607:17	–	nvd

[
  {
    "vendor": "prodigycommerce",
    "product": "Prodigy Commerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/frontend/shortcodes/class-prodigy-short-code-my-account.php
plugins	www.plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/frontend/class-prodigy-public.php
plugins	www.plugins.trac.wordpress.org/changeset/3464655/
plugins	www.plugins.trac.wordpress.org/browser/prodigy-commerce/tags/3.2.9/includes/helpers/class-prodigy-template.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/de255530-6b2d-426b-9f80-dbfebd2e3307
plugins	www.plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/helpers/class-prodigy-template.php

Parameter	Position	Path	Description	CWE
parameters[template_name]	request body	wp-admin/admin-ajax.php	Local File Inclusion via parameters[template_name] in Prodigy Commerce <=3.3.0 allowing unauthenticated file read/execute	CWE-98
parameters[default_path]	request body	wp-admin/admin-ajax.php	Local File Inclusion via parameters[template_name] in Prodigy Commerce <=3.3.0 allowing unauthenticated file read/execute	CWE-98
action	request body	wp-admin/admin-ajax.php	Local File Inclusion via parameters[template_name] in Prodigy Commerce <=3.3.0 allowing unauthenticated file read/execute	CWE-98
nonce	request body	wp-admin/admin-ajax.php	Local File Inclusion via parameters[template_name] in Prodigy Commerce <=3.3.0 allowing unauthenticated file read/execute	CWE-98

17 Jun 2026 10:11Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.19.8

EPSS0.09396

SSVC

CWE-98