CVE-2026-28570

HighCVSS 8.1

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

The Vavo Core plugin versions up to 2.3.0 contain an unauthenticated Local File Inclusion vulnerability. An attacker without logging in can include local files from the server.

Risk Assessment

The risk includes the possibility of reading sensitive files from the server, such as configuration files or credentials, which could lead to security compromise.

Recommendation

It is recommended to update the Vavo Core plugin to the latest version that includes a fix for this vulnerability.

Original NVD description (English source)

Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.