CVE-2026-54845
Deferred Deferred - Pending Action
Unauthenticated Local File Inclusion in MDTF

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: Patchstack

Description
Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-54845
EUVD
EUVD-2026-39372
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack mdtf_plugin to 1.3.9 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability allows attackers to include local files on the target website, potentially exposing sensitive data such as database credentials. This exposure could lead to a complete database takeover depending on the server configuration.

Such unauthorized access and potential data exposure can compromise the confidentiality and integrity of personal and sensitive information, which are critical requirements under common standards and regulations like GDPR and HIPAA.

Therefore, if exploited, this vulnerability could lead to non-compliance with these regulations due to the risk of data breaches and unauthorized data access.

Executive Summary

CVE-2026-54845 is a Local File Inclusion (LFI) vulnerability found in the WordPress MDTF Plugin versions 1.3.8 and below.

This vulnerability allows unauthenticated attackers to include local files on the target website, which can expose sensitive information such as database credentials.

Depending on the server configuration, this could lead to a complete takeover of the database.

The vulnerability is classified under the OWASP Top 10 category A3: Injection and has a high severity score of 8.1.

Impact Analysis

Exploitation of this vulnerability can lead to exposure of sensitive data such as database credentials.

Attackers may gain unauthorized access to the database, potentially resulting in a complete database takeover.

This can compromise the confidentiality, integrity, and availability of your website and its data.

Due to the high severity and ease of exploitation, it poses a significant risk especially in mass attack campaigns targeting many websites.

Mitigation Strategies

Immediate action is required to mitigate the risk of the Local File Inclusion vulnerability in MDTF Plugin versions 1.3.8 and below.

  • Update the MDTF plugin to version 1.3.9 or later.
  • Seek assistance from your hosting provider or a web developer if you cannot update immediately.
  • Apply the mitigation rule provided by Patchstack to block attacks until the plugin is updated.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54845. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart