CVE-2026-28152

Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...

CVE-2026-28152 WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...

CVE-2026-28152

CVE-2026-28152 is an unauthenticated Local File Inclusion (LFI) vulnerability in the WordPress plugin Tonda Core , affecting versions below 2.6 . Discovered by Tran Nguyen Bao Khanh (VCI – VNPT Cyber Immunity), the flaw allows an unauthenticated remote attacker to include local files, resulting i...