PT-2026-43206 · Unknown · Magentech Sw Core

João Pedro S Alcântara + 1 · Published 2026-05-26 · Updated 2026-06-09 · CVE-2026-39661

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magentech SW Core versions prior to 1.7.18

Description Improper Control of Filename for Include/Require Statement in PHP Program (PHP Remote File Inclusion) allows for PHP Local File Inclusion. This occurs when the application fails to properly validate the filename used in include or require statements, potentially allowing an attacker to include files from the local system.

Recommendations Update to version 1.7.18 or later.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-39661

Affected Products

Magentech Sw Core

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-39661 · Security Note
• https://twitter.com/VulmonFeeds/status/2059281016989143103 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/sw_core/vulnerability/wordpress-sw-core-plugin-1-7-18-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/Aftershockindex/status/2064225884278509634 · Twitter Post
• https://reddit.com/r/StopBadBots/comments/1twww49/insane_record_145_wordpress_plugins_exposed_with · Reddit Post
• https://t.me/CVEtracker/54966 · Telegram Post