PT-2026-20630 · WordPress · Prodigy Commerce+1

Athiwat Tiprasaharn + 2 · Published 2026-02-19 · Updated 2026-03-17 · CVE-2026-0926

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prodigy Commerce versions prior to 3.2.9

Description The Prodigy Commerce plugin for WordPress is susceptible to a Local File Inclusion issue. This allows unauthenticated attackers to include and read arbitrary files or execute arbitrary files on the server. Exploitation of this issue can lead to bypassing access controls, obtaining sensitive data, or achieving code execution. The vulnerability is due to insufficient input validation of the parameters[template name] parameter. This allows attackers to include and execute PHP code within uploaded files.

Recommendations Versions prior to 3.2.9 should be updated. As a temporary workaround, consider disabling the Prodigy Commerce plugin until a fix is available. Monitor file uploads for potentially malicious content.

Fix

RCE

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-0926

Affected Products

Prodigy Commerce

Wordpress

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-0926 · Security Note
• https://twitter.com/0dayPublishing/status/2024347030986883329 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3464655 · Note
• https://twitter.com/offseq/status/2024363372829901043 · Twitter Post
• https://t.me/CVEtracker/45078 · Telegram Post
• https://plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/helpers/class-prodigy-template.php#L55 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/de255530-6b2d-426b-9f80-dbfebd2e3307?source=cve · Note
• https://plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/frontend/class-prodigy-public.php#L491 · Note
• https://twitter.com/CveTodo/status/2024532246862983535 · Twitter Post
• https://twitter.com/CVEnew/status/2024360210031399389 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2028074430820127004 · Twitter Post
• https://plugins.trac.wordpress.org/browser/prodigy-commerce/trunk/includes/frontend/shortcodes/class-prodigy-short-code-my-account.php#L69 · Note
• https://twitter.com/pdnuclei_bot/status/2033694845584478643 · Twitter Post
• https://plugins.trac.wordpress.org/browser/prodigy-commerce/tags/3.2.9/includes/helpers/class-prodigy-template.php#L55 · Note