CVE-2026-0926
CriticalPublic exploitProdigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]
Published Feb 19, 2026 · Updated Apr 8, 2026 · Also known as de255530-6b2d-426b-9f80-dbfebd2e3307
Key Facts
Patch immediately- CVE-2026-0926 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Prodigy Commerce (wordpress-plugin).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 9.3% probability of exploitation in the next 30 days.
- Fixed versions are available, including Prodigy Commerce 3.3.1.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
9.3%
Higher than 95.3% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-0926 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arbitrary files or execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Prodigy Commercewordpress-plugin | See advisory | 3.3.1 |
Patched Releases
Prodigy Commerce
3.3.1
Timeline
Publicly disclosed
Feb 19, 2026
Last updated
Apr 8, 2026
Weakness Type
- CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
References
- advisoryhttps://www.wordfence.com/threat-intel/vulnerabilities/id/de255530-6b2d-426b-9f80-dbfebd2e3307?source=api-prod
- advisoryhttps://www.wordfence.com/threat-intel/vulnerabilities/id/de255530-6b2d-426b-9f80-dbfebd2e3307?source=api-scan
- exploitExploitDB-52598
- otherhttps://plugins.trac.wordpress.org/browser/prodigy-commerce/tags/3.2.9/includes/helpers/class-prodigy-template.php#L55
- otherhttps://plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/frontend/class-prodigy-public.php#L491
FAQ
Common Questions.
The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter.
Affected: Prodigy Commerce (wordpress-plugin). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Prodigy Commerce 3.3.1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-0926 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo