Unauthenticated Local File Inclusion in Softlab Core

Executive Summary

CVE-2026-34895 is a Local File Inclusion (LFI) vulnerability found in the WordPress Softlab Core Plugin versions prior to 1.2.11. This vulnerability allows unauthenticated attackers to include local files on the target website.

Exploiting this flaw can lead to exposure of sensitive data such as database credentials and may result in a complete database takeover.

The vulnerability is considered high priority with a CVSS score of 8.1 and falls under the OWASP Top 10 category A3: Injection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive information like database credentials.

Attackers can potentially take over the entire database, leading to data breaches, data loss, or manipulation.

Because the vulnerability is exploitable without authentication, it poses a significant risk and may be targeted in widespread attack campaigns.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the WordPress Softlab Core Plugin to version 1.2.11 or later.

If updating the plugin is not possible immediately, users should seek assistance from their hosting provider or web developer.

Additionally, Patchstack has provided a mitigation rule to block attacks targeting this vulnerability until the plugin can be updated.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to include local files on the target website, potentially exposing sensitive data such as database credentials and enabling a complete database takeover.

Exposure of sensitive data due to this vulnerability could lead to non-compliance with data protection regulations and standards like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Therefore, organizations using affected versions of the Softlab Core plugin may face increased risk of violating these regulations if the vulnerability is exploited.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability is a Local File Inclusion (LFI) in the WordPress Softlab Core Plugin versions prior to 1.2.11, exploitable without authentication. Detection typically involves monitoring for suspicious HTTP requests attempting to include local files.

To detect exploitation attempts on your system or network, you can look for HTTP requests containing typical LFI payloads such as directory traversal patterns (e.g., ../) or attempts to access sensitive files like /etc/passwd or wp-config.php.

• Use web server access logs to search for suspicious requests, for example with grep:
• grep -iE "(\.{2}/|etc/passwd|wp-config\.php)" /var/log/apache2/access.log
• Use network monitoring tools or intrusion detection systems (IDS) with rules to detect LFI patterns targeting the Softlab Core plugin.
• Apply the mitigation rule provided by Patchstack to block attack attempts until the plugin is updated.

Immediate updating of the plugin to version 1.2.11 or later is the recommended action to prevent exploitation.

Useful 0 Not Useful 0