A local file inclusion vulnerability in the Prodigy Commerce WordPress plugin affects versions up to 3.2.9. Tracked as CVE-2026-0926, the flaw lets unauthenticated attackers include and execute arbitrary files on the server by manipulating the parameters[template_name] parameter.
An attacker just needs to grab a nonce from the page source, then send a POST request to /wp-admin/admin-ajax.php with the template_name parameter set to any file path — /etc/passwd works for proof of concept. The plugin returns the file contents in its JSON response.
This is unauthenticated, meaning anyone can exploit it without needing an account on the target site. If you’re running Prodigy Commerce on WordPress, update to the latest version immediately.
