Prodigy Commerce WordPress Plugin — Unauthenticated Local File Inclusion (CVE-2026-0926)

Metadata

Affected Target

Summary

Prodigy Commerce exposes an AJAX action, prodigy-render-my-account-widget, that renders a “My Account” widget template chosen via the parameters[template_name] POST parameter. The plugin fails to sanitize or restrict this parameter to an allow-list of legitimate templates, so it is passed into a PHP file-include operation largely as-is. An unauthenticated attacker can supply an arbitrary filesystem path (e.g. /etc/passwd) as the template name and have the plugin include and render that file’s contents back in the AJAX JSON response. The PoC harvests the required AJAX nonce from the page, then submits the malicious admin-ajax.php request and prints the returned file contents.

Vulnerability Details

Root Cause

The parameters[template_name] value from an unauthenticated AJAX request is used directly to build a file path that is included/rendered by the widget renderer, without validating it against a fixed set of known template names or stripping path traversal sequences.

Attack Vector

1. GET the target site’s homepage and extract the nonce value embedded in an inline settings JS object.
2. POST to /wp-admin/admin-ajax.php with action=prodigy-render-my-account-widget, the harvested nonce, and parameters[template_name] set to the target file path (e.g. /etc/passwd), with parameters[default_path]=/.
3. The plugin includes the referenced file and returns its rendered output inside the JSON data.html field.
4. Read arbitrary local files, including configuration files (e.g. wp-config.php) that may leak database credentials or secret keys.

Impact

Unauthenticated disclosure of arbitrary files readable by the web server user, potentially exposing wp-config.php secrets and enabling further compromise (e.g. remote code execution if combined with log/session poisoning).

Environment / Lab Setup

Target:   WordPress site running Prodigy Commerce <= 3.2.9
Attacker: Python 3, `pip install httpx`

Proof of Concept

PoC Script

See CVE-2026-0926.py in this folder.

1

python CVE-2026-0926.py -u http://target.local -f /etc/passwd

The script fetches the target’s AJAX nonce, sends the crafted prodigy-render-my-account-widget request with the requested file path in parameters[template_name], and prints the included file’s contents from the JSON response.

Detection & Indicators of Compromise

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=prodigy-render-my-account-widget&nonce=<VALUE>&parameters[template_name]=/etc/passwd&parameters[default_path]=/

Signs of compromise:

• Access log entries showing repeated POSTs to admin-ajax.php with action=prodigy-render-my-account-widget and unusual template_name values (absolute paths, ../ sequences).
• AJAX responses containing content that resembles system or config files rather than an account widget.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/diamorphine666/CVE-2026-0926-exploit on 2026-07-05.