High · published January 22, 2026
⚡ A missing control in the WerkStatt Plugin lets attackers include any file they want—like a rogue chef grabbing secret recipes from the pantry! Think of it like a restaurant where the chef can access any ingredient without checks. If they can reach for anything in the backroom, who knows what they might cook up? This vulnerability allows attackers to include local files, potentially running malicious PHP code! An attacker could exploit this vulnerability to execute arbitrary PHP code on the server. This means they could access sensitive files, manipulate data, or even take full control of the server—absolutely devastating consequences for any website relying on this plugin!
Think of it like a restaurant where the chef can access any ingredient without checks. If they can reach for anything in the backroom, who knows what they might cook up? This vulnerability allows attackers to include local files, potentially running malicious PHP code! This CVE highlights an improper control of filenames in include/require statements in the WerkStatt Plugin, enabling local file inclusion (LFI). The vulnerability affects versions from n/a up to 1.6.6, allowing attackers to include local files with a crafted request.
An attacker could exploit this vulnerability to execute arbitrary PHP code on the server. This means they could access sensitive files, manipulate data, or even take full control of the server—absolutely devastating consequences for any website relying on this plugin! To mitigate this risk, developers should immediately update the WerkStatt Plugin to the latest version that addresses this vulnerability. Additionally, consider implementing robust input validation to prevent unauthorized file inclusions. Don't wait—this is critical! You've got this! Follow those steps and secure your site like a pro! 🛡️