CVE-2026-24538
Published: 23 January 2026
Summary
CVE-2026-24538 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI flaw in public-facing WordPress/PHP plugin directly enables T1190 initial access and subsequent web shell deployment/execution via arbitrary file inclusion.
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in omnipressteam Omnipress omnipress allows PHP Local File Inclusion.This issue affects Omnipress: from n/a through <= 1.6.7.
Deeper analysisAI
CVE-2026-24538 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion (CWE-98). It affects the Omnipress WordPress plugin developed by omnipressteam, impacting all versions from n/a through 1.6.7.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network by an attacker possessing low privileges. It requires high attack complexity and no user interaction, with successful attacks enabling high impacts on confidentiality, integrity, and availability through local file inclusion.
Advisories, including the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/omnipress/vulnerability/wordpress-omnipress-plugin-1-6-6-local-file-inclusion-vulnerability?_s_id=cve, provide details on the vulnerability in the Omnipress plugin.
Details
- CWE(s)