CVE-2026-11426

Name of the Vulnerable Software and Affected Versions UnderConstructionPage PRO versions prior to 5.77

Description An Arbitrary File Read issue exists where the plugin accepts arbitrary local file paths through the template thumbnail parameter and copies the contents of those files into a publicly accessible uploads folder. This allows authenticated attackers with Subscriber-level access or higher to read sensitive files from the server.

Recommendations Update UnderConstructionPage PRO to a version later than 5.76. Avoid using the template thumbnail parameter until the update is applied.