Description

Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T14:17:09.477Z",
  "pubdate": "2026-08-13T14:17:09.477Z",
  "executiveSummary": "An unauthenticated Local File Inclusion (LFI) vulnerability has been identified in the Biagiotti Core plugin, affecting versions 2.1.1 and prior.\nThis security flaw enables unauthenticated remote threat actors to traverse the filesystem of the underlying web server and include arbitrary local files for execution or retrieval.\nThe primary impact of successful exploitation includes the potential disclosure of sensitive configuration files, system credentials, and application source code, which could lead to complete system compromise.\nThe risk implication is critical due to the lack of required authentication, allowing any network-based attacker to interact directly with the vulnerable parameter.\nExploitation requirements are minimal, as the attack vector requires no prior privileges or user interaction, relying solely on network accessibility to the targeted WordPress instance running the vulnerable plugin version.",
  "technicalDetails": "The vulnerability resides within the Biagiotti Core plugin, specifically affecting versions <= 2.1.1, stemming from insufficient validation and sanitization of user-supplied input passed to the file inclusion mechanisms.\nThe root cause is improper input handling where parameters controlling file loading or template rendering accept directory traversal sequences (e.g., ../) without adequately restricting the scope of accessible file paths.\nBecause the vulnerability is unauthenticated, an attacker does not need valid user credentials or session tokens to interact with the vulnerable component exposed over the network via HTTP or HTTPS protocols.\nThe attack flow proceeds as follows: First, the attacker identifies a vulnerable endpoint or parameter within the Biagiotti Core plugin that handles file paths dynamically. Second, the attacker crafts a malicious HTTP request incorporating directory traversal sequences designed to navigate outside the intended web root directory and target sensitive system files such as /etc/passwd or application-specific configuration files containing database credentials. Third, the application processes the tainted input and includes the targeted local file. Finally, the contents of the included file are reflected back to the attacker within the HTTP response or executed depending on the server configuration and inclusion function context.\nPayload behavior typically involves the injection of dot-dot-slash sequences to traverse the absolute or relative directory structure. Post-exploitation impact can be severe, ranging from sensitive data exposure to remote code execution if the environment permits local file inclusion coupled with file upload capabilities or log poisoning techniques."
}