CVE-2026-48972

Vulnerability

The SeedProd Pro plugin for WordPress versions before 6.19.5 is vulnerable to PHP Local File Inclusion due to improper control of filename for include/require statements. An attacker can exploit this to include arbitrary local files from the server [1].

Exploitation

The attacker needs to be able to send crafted requests to the vulnerable site. No authentication is mentioned as required, so it may be unauthenticated. The exact sequence involves manipulating the filename parameter in a PHP include/require call to point to a local file [1].

Impact

Successful exploitation allows the attacker to read sensitive local files, such as wp-config.php containing database credentials, potentially leading to complete site compromise [1].

Mitigation

Update to version 6.19.5 or later to fix the vulnerability. The plugin developer released this patched version [1]. Users unable to update immediately should consider disabling the plugin or seeking hosting provider assistance.