CVE-2026-28570

The WordPress plugin Vavo Core (versions ≤ 2.3.0) is vulnerable to unauthenticated Local File Inclusion, allowing remote attackers to read or include arbitrary server files without authentication. CVSS 3.1 scores it HIGH (8.1). No patch version or remediation is provided in the documents; upgradi...