CVE-2026-84069CWE-22path-traversal

CVE-2026-84069

Medium · published September 27, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00262 · 17.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-27T10:17Z
References (1)
https://wpscan.com/vulnerability/04965370-b4f4-4629-a9b1-7450fcf6aeee/ · [email protected]
EPSS history
Timeline
  • 28 SEP 03:29Z
    EPSS moved — → 0%
    epss
  • 27 SEP 06:00Z
    WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php
    cvelistv5