CVE-2026-28039
Published: 05 March 2026
Summary
CVE-2026-28039 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress plugin directly enables exploitation of T1190; successful abuse leads to arbitrary PHP execution (T1059.004 Unix Shell) and common web shell deployment (T1505.003).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpDataTables wpDataTables wpdatatables allows PHP Local File Inclusion.This issue affects wpDataTables: from n/a through <= 6.5.0.1.
Deeper analysisAI
CVE-2026-28039 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the wpDataTables WordPress plugin. This issue affects wpDataTables versions from n/a through 6.5.0.1. The vulnerability was published on 2026-03-05 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote, unauthenticated attacker can exploit this vulnerability over the network with high attack complexity, requiring user interaction such as clicking a malicious link or input. Successful exploitation allows high-impact consequences to confidentiality, integrity, and availability, potentially enabling attackers to include and execute arbitrary local PHP files, leading to sensitive data disclosure or remote code execution on the targeted WordPress site.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-6-4-0-5-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)