CVE-2026-78562
Received Received - Intake

Vulnerable WordPress Verdure Core Plugin Local File Inclusion

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Wordfence

Description
The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-78562
EUVD
EUVD-2026-65325

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
verdure core to 1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Verdure Core WordPress plugin up to version 1.2 has a Local File Inclusion vulnerability. Unauthenticated attackers can include and execute arbitrary files on the server, including PHP files. This allows them to run malicious code, bypass access controls, steal sensitive data, or take over the site if safe file uploads are possible.

Detection Guidance

Check for the presence of the Verdure Core plugin in your WordPress installation. Look for unusual file inclusions or PHP code execution attempts in server logs. No specific commands are provided in the context.

Impact Analysis

If you use this plugin, attackers could gain full control of your WordPress site. They might steal user data, install malware, deface your site, or use it to attack visitors. Even if you restrict file uploads, the flaw could still allow code execution through included files.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. If exploited, it may result in data breaches, leading to legal penalties, fines, and reputational damage due to non-compliance with these regulations.

Mitigation Strategies

Immediately update the Verdure Core plugin to the latest version if available. If no update exists, consider disabling or removing the plugin until a patch is released. Restrict file uploads to trusted sources and monitor server logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78562. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart