CVE-2026-0926 Scanner

Prodigy Commerce is a WordPress plugin designed for small to medium-sized businesses to create and manage online stores. It simplifies product listings, order management, and payment processing, integrating seamlessly with various themes. Users rely on it for its customizable features and support for multiple payment gateways, making it a popular choice for retailers seeking an easy e-commerce solution without extensive technical knowledge.

Local File Inclusion (LFI) is a vulnerability that occurs when user input is not properly sanitized, allowing attackers to include arbitrary files from the server. In Prodigy Commerce, this arises due to insufficient validation of file paths in certain functions, enabling malicious actors to traverse directories and access sensitive files outside the intended scope.

The vulnerability specifically affects the 'download' endpoint in Prodigy Commerce versions prior to 3.2.9. The 'file' parameter is not sanitized, allowing path traversal sequences like '../' to read files such as '/etc/passwd' or WordPress configuration files. This endpoint is used for downloading invoices or receipts, making it a prime target for exploitation.

If exploited, an attacker can read sensitive server files, including database credentials, API keys, and source code. This can lead to full site compromise, data breaches, and potential remote code execution if combined with other vulnerabilities. The high CVSS score of 9.8 reflects the critical risk to confidentiality, integrity, and availability.