CVE-2026-34895

Name of the Vulnerable Software and Affected Versions Softlab Core versions prior to 1.2.11

Description An unauthenticated Local File Inclusion (LFI) exists in the Softlab Core plugin for WordPress. LFI is a vulnerability that allows an attacker to include files on the server that are outside the application's root directory. This flaw enables unauthenticated attackers to include and execute arbitrary files, potentially leading to the execution of PHP code. This can be leveraged to bypass access controls or obtain sensitive data, particularly when images or other safe file types can be uploaded and subsequently included.

Recommendations Update Softlab Core to version 1.2.11 or later.