CVE-2026-28157 HIGH

CVE-2026-28157: WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability

Vendor Lasso Analytics, Inc.

Product Do Lasso

Weakness CWE-35

Published August 13, 2026

Last update August 13, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Subscriber Path Traversal in Do Lasso <= 358 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Do Lasso versions 358 and earlier contain a path traversal vulnerability that allows authenticated users to read, modify, or delete files on the server by manipulating file paths with multiple leading dots. The vulnerability requires low-level authentication and high attack complexity, but successful exploitation grants full read, write, and delete access to sensitive files outside the intended directory.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete files on the server outside the intended directory.

Potential impact on your site

04Site Impact

Authenticated users can access sensitive configuration files, database credentials, or other protected data stored on the server.

Conditions required to exploit

05Prerequisites

Attacker must have low-level user authentication; no user interaction required.

Key dates

06Disclosure timeline

August 13, 2026 CVE published

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-28157 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/35.html AskarLabs — CWE-35 write-up Path Traversal (Multiple Leading Dots)

Related vulnerabilities