CVE-2026-112820: WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability

Q: Does exploitation require an authenticated WordPress account or user interaction?

No. The CVSS vector indicates no privileges are required and no user interaction is required.

Q: Can an attacker attempt exploitation remotely?

Yes. The attack vector is network-based, so an attacker can attempt exploitation remotely. The attack complexity is rated high, indicating additional conditions are needed for a successful exploit.

Q: Which installations should be considered affected?

Academist Core versions through 1.4.1 are affected. No fixed version is identified in the provided data.

Published Oct 22, 2026

Updated

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.

Affected Software

0 affected components

Event History

Oct 22, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated WordPress account or user interaction?

No. The CVSS vector indicates no privileges are required and no user interaction is required.

Can an attacker attempt exploitation remotely?

Yes. The attack vector is network-based, so an attacker can attempt exploitation remotely. The attack complexity is rated high, indicating additional conditions are needed for a successful exploit.

Which installations should be considered affected?