CVE-2026-3826 CRITICAL

CVE-2026-3826: WellChoose｜IFTOP - Local File Inclusion

Vendor Wellchoose

Product IFTOP

Weakness CWE-98 · PHP file inclusion

Published March 11, 2026

Last update March 11, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

IFTOP developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server.

Key dates

02Disclosure timeline

March 11, 2026 CVE published

March 11, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-3826

Related vulnerabilities

04Related CVE

CVE-2025-49362 WordPress Gracioza theme <= 1.0.15 - Local File Inclusion vulnerability CVE-2025-26735 WordPress Grip theme <= 1.0.9 - Local File Inclusion vulnerability CVE-2025-67980 WordPress Hara theme <= 1.2.17 - Local File Inclusion vulnerability CVE-2025-69374 WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 2.0.3 - Local File Inclusion vulnerability CVE-2026-22415 WordPress The Mounty theme <= 1.1 - Local File Inclusion vulnerability