What the vulnerability does
01Description
The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Explanation of Vulnerability in Simple Terms
02Summary
The News and Blog Designer Bundle versions 1.1 and earlier contain a critical vulnerability that allows unauthenticated attackers to read sensitive data, modify site content, and disrupt service availability. The vulnerability requires no user interaction and can be exploited remotely over the network. All installations of version 1.1 or earlier are affected and should be updated immediately.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify or delete content, and disrupt site availability without authentication.
Potential impact on your site
04Site Impact
Your site's data, content, and availability are at immediate risk from remote attackers without any barriers to entry.
Conditions required to exploit
05Prerequisites
Network access only; no authentication, user interaction, or special configuration required.
Key dates
06Disclosure timeline
January 14, 2026
CVE published
April 8, 2026
Record updated
