Known CVE

Prodigy Commerce <= 3.3.0 - Local File Inclusion

Prodigy Commerce WordPress plugin <= 3.2.9 contains a local file inclusion caused by improper sanitization of 'parameters[template_name]' parameter, letting unauthenticated attackers include and execute arbitrary files remotely.

CVE-2026-0926

Critical2026CVSS 9.8CWE-98

cve2026 · wordpress · wp · wp-plugin · lfi · prodigy-commerce · unauth

Verified scans run this check after you prove you own the site.

All known CVEs View the checks catalog National Vulnerability Database

Scan a website