PT-2026-42104 · WordPress · Advanced Database Cleaner – Premium

Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-7522

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advanced Database Cleaner – Premium versions prior to 4.1.1

Description The Advanced Database Cleaner – Premium plugin for WordPress contains a Local File Inclusion issue, which occurs when an application includes a file without properly validating the input, allowing an attacker to read or execute files on the server. Authenticated attackers with Subscriber-level access or higher can use the template parameter to include and execute arbitrary .php files. This can lead to the bypass of access controls, unauthorized access to sensitive data, or remote code execution if .php files can be uploaded to the server.

Recommendations Update the plugin to a version later than 4.1.0. As a temporary workaround, restrict access to the template parameter to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-7522

Affected Products

Advanced Database Cleaner – Premium

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-7522 · Security Note
• https://docs.sigmaplugin.com/article/97-advanced-database-cleaner-chaneglog · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/77e4e516-8a12-48ee-9124-27f941b68b13?source=cve · Note
• https://sigmaplugin.com/downloads/wordpress-advanced-database-cleaner · Note
• https://twitter.com/CVEnew/status/2056994189628637235 · Twitter Post