CVE-2026-28157
Received Received - Intake

BaseFortify

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Patchstack

Description
Subscriber Path Traversal in Do Lasso <= 358 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-28157
EUVD
EUVD-2026-57950

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
patchstack do_lasso_plugin to 358 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-35 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-28157 is a Path Traversal vulnerability in the WordPress Do Lasso Plugin versions 358 and below. This flaw allows attackers to access unauthorized files or directories on a server by manipulating file paths. The vulnerability has a high CVSS score of 7.5, indicating significant risk.

Detection Guidance

Since there is no official patch available, detection may involve monitoring for unusual file access patterns or suspicious requests targeting the Do Lasso plugin. Check web server logs for paths containing sequences like '../' or encoded traversal strings. Use tools like grep to search logs for 'do_lasso' or 'path traversal' patterns.

Impact Analysis

This vulnerability could allow attackers to read sensitive files, execute arbitrary code, or gain unauthorized access to a website. It may be exploited in mass campaigns targeting thousands of sites. Immediate action is advised due to the high risk.

Mitigation Strategies

Immediately apply Patchstack's mitigation rule if available through their service. Disable or uninstall the Do Lasso plugin if not essential. Restrict file access permissions on the web server to limit exposure. Consider seeking help from a hosting provider or web developer to implement temporary fixes until an official patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28157. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart