CVE-2026-112820 in Academist Core Plugin
Summary
by MITRE • 10/22/2026
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified involves an improper control of a filename within the include or require statement logic of the PHP application code in Elated-Themes Academist Core, specifically affecting versions up to and including 1.4.1. This flaw fundamentally represents a failure by the software to properly validate user-supplied input before utilizing it as part of a dynamic file path for inclusion operations. In standard web development practices, when an application needs to load external PHP files dynamically based on configuration or user interaction, it must rigorously sanitize and verify that the provided filename corresponds strictly to expected local resources within the designated directory structure. The absence of such validation mechanisms allows an attacker to manipulate the input parameter, thereby subverting the intended execution flow of the script.
This specific technical flaw is classified under Common Weakness Enumeration as CWE-98 Improper Control of Filename for Include Statement, often colloquially referred to in broader contexts as Remote File Inclusion or Local File Inclusion depending on whether the attacker can supply a remote URL or only local paths. While the initial description mentions PHP Remote File Inclusion capabilities due to legacy server configurations that may allow include_url wrappers, the core issue described is the lack of input validation leading to arbitrary file inclusion. By injecting maliciously crafted filenames into parameters such as those passed via GET or POST requests, an attacker can force the vulnerable script to execute code from unintended locations. If local file paths are permitted in the injection vector, this constitutes a Local File Inclusion vulnerability which can be leveraged for information disclosure by reading sensitive system files like /etc/passwd or configuration files containing database credentials.
The operational impact of this vulnerability is severe and multifaceted. An authenticated or unauthenticated attacker, depending on the specific endpoint's access controls, can achieve arbitrary code execution on the target server if they can include a PHP file containing malicious payloads. This effectively grants the attacker full control over the web application environment, allowing them to escalate privileges, install backdoors, deface websites, or pivot into internal network segments. Even in scenarios where remote file inclusion is disabled by php.ini settings, local file inclusion remains a critical risk because it enables data exfiltration and can serve as an initial foothold for more complex attack chains involving log poisoning or race conditions to achieve code execution through other application features.
From the perspective of industry frameworks such as MITRE ATT&CK, this vulnerability aligns with techniques related to Server-Side Request Forgery if remote resources are involved, but primarily falls under exploitation vectors that allow unauthorized access to system files and subsequent command injection via included scripts. The attack pattern typically involves crafting a URL parameter where the filename argument points outside the allowed directory tree or references an external resource controlled by the attacker. This bypasses standard security boundaries because the web server treats the included file as part of its own execution context, thereby inheriting the same permissions and privileges as the original script.
Mitigation strategies must focus on strict input validation and secure coding practices within the PHP environment. Developers should implement a whitelist approach for any dynamic includes, ensuring that only predefined, expected filenames are allowed to be loaded. Alternatively, using absolute paths with fixed base directories can prevent directory traversal attacks such as those utilizing dot-dot-slash sequences. Additionally, disabling the allow_url_include directive in php.ini is a critical server-level defense that prevents remote file inclusion entirely, reducing the attack surface significantly. For existing deployments of Academist Core prior to version 1.4.2, immediate patching or upgrading to the latest secure version provided by Elated-Themes is essential to resolve this code execution risk and restore the integrity of the application's security posture.