CVE-2026-84069
Received Received - Intake

Local File Inclusion in WebFacing WordPress Plugin

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: WPScan

Description
The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-84069
EUVD
EUVD-2026-87885

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
webfacing webfacing_wordpress_plugin to 5.4 (exc)
webfacing webfacing_email_accounts_for_cpanel From 5.3 (inc) to 5.3.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WebFacing WordPress plugin before version 5.4 has a vulnerability where it does not restrict access to a bundled script and fails to validate user-supplied paths. This allows unauthenticated users to perform Local File Inclusion (LFI) attacks by including arbitrary local files.

Detection Guidance

Check if the WebFacing WordPress plugin version is below 5.4. Inspect the assets/index.php script for improper access restrictions and validate if user-supplied paths are properly sanitized. Use WPScan to scan for vulnerable versions.

Impact Analysis

An attacker could exploit this to read sensitive files on the server, potentially exposing confidential data like configuration files, user credentials, or other critical system information. This could lead to further attacks or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the WebFacing WordPress plugin to version 5.4 or later immediately. Remove or restrict access to the assets/index.php script if an update is not possible. Monitor for unauthorized file inclusion attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84069. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart