PT-2026-34300 · Doctorwp · Breaking News Wp

Published

2026-04-22

·

Updated

2026-04-22

·

CVE-2026-4280

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The Breaking News WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3. This is due to the brnwp ajax form AJAX endpoint lacking both authorization checks and CSRF verification, combined with insufficient path validation when the brnwp theme option value is passed directly to an include() statement in the brnwp show breaking news wp() shortcode handler. While sanitize text field() is applied to user input, it does not strip directory traversal sequences (../). This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the brnwp theme option with a directory traversal payload (e.g., ../../../../etc/passwd) and subsequently trigger file inclusion of arbitrary files on the server when the shortcode is rendered.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-4280

Affected Products

Breaking News Wp