CVE-2026-34893
Deferred Deferred - Pending Action

Unauthenticated Local File Inclusion in Thegov Core

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Patchstack

Description
Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-07-08
AI Q&A
2026-06-17
EPSS Evaluated
2026-07-06
NVD
CVE-2026-34893
EUVD
EUVD-2026-37465

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
patchstack thegov_core to 2.0.23 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-34893 is a Local File Inclusion (LFI) vulnerability found in The WordPress Thegov Core Plugin versions below 2.0.23. This flaw allows an attacker to include local files on the target website without needing any authentication.

Exploiting this vulnerability can lead to exposure of sensitive data such as database credentials. Depending on the server configuration, this could result in a complete database takeover.

The vulnerability is classified as high risk with a CVSS score of 8.1 and falls under the OWASP Top 10 category A3: Injection.

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive files on your server.

  • Exposure of sensitive data such as database credentials.
  • Potential complete takeover of the database depending on server configuration.
  • Compromise of the website's integrity, confidentiality, and availability.
Mitigation Strategies

Immediate action is recommended to mitigate the Local File Inclusion vulnerability in Thegov Core Plugin versions below 2.0.23.

  • Update the Thegov Core Plugin to version 2.0.23 or later.
  • Apply the mitigation rule provided by Patchstack to block attacks until the update can be applied.
  • If using Patchstack, enable auto-updates for vulnerable plugins to automatically mitigate the risk.
Compliance Impact

The vulnerability allows unauthenticated attackers to include local files on the target website, potentially exposing sensitive data such as database credentials. This exposure could lead to a complete database takeover depending on the server configuration.

Such exposure of sensitive data can impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information from unauthorized access and breaches.

Therefore, if exploited, this vulnerability could result in violations of data protection requirements mandated by these regulations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34893. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart