CVE-2026-24390: 
WordPress vulnerability analysis and mitigation

CVE-2026-24390 is a Local File Inclusion (LFI) vulnerability in the QantumThemes Kentha Elementor Widgets plugin for WordPress. It affects all versions prior to 3.1 and was published on January 22, 2026, with Patchstack crediting researcher João Pedro S Alcântara (Kinorth) for the discovery (reported December 25, 2025). The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Patchstack, Feedly).

The root cause is classified as CWE-98 — Improper Control of Filename for Include/Require Statement in PHP Program (PHP Remote File Inclusion/Local File Inclusion). The plugin fails to properly sanitize or validate user-supplied input used in PHP include/require statements, allowing an attacker to manipulate the filename parameter to include arbitrary local files from the server's filesystem. Exploitation requires low-level authenticated access (Contributor or Developer role) and is rated high complexity, meaning some preconditions or non-default configurations must be met (Patchstack, Feedly).

Successful exploitation allows an authenticated attacker to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as wp-config.php (which contains database credentials). This could lead to full database compromise, credential theft, and potentially further lateral movement within the hosting environment. Confidentiality, integrity, and availability are all rated as high impact in the CVSS scoring (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.053% (0.000530), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes it is unlikely to be exploited due to its low priority classification, though LFI vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites running the Kentha Elementor Widgets plugin at a version below 3.1 using tools like WPScan or Shodan queries targeting plugin-specific file paths.
2. Obtain low-privilege access: Acquire a Contributor or Developer account on the target WordPress site (e.g., via credential stuffing, phishing, or registration if open).
3. Identify vulnerable parameter: Locate the plugin's widget or shortcode that accepts a filename or template parameter passed to a PHP include/require statement.
4. Craft LFI payload: Submit a crafted request with a path traversal payload (e.g., ../../../../wp-config.php) in the vulnerable parameter to include a sensitive local file.
5. Retrieve sensitive data: The server renders and outputs the contents of the included file (e.g., database credentials from wp-config.php), which the attacker can then use for further compromise (Patchstack).

• Logs: WordPress access logs showing requests to plugin endpoints with path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body fields.
• Logs: PHP error logs referencing unexpected file inclusion attempts or include/require failures for files outside the plugin directory.
• Network: Unusual outbound connections from the web server following authenticated requests to Kentha Elementor widget endpoints (may indicate chained exploitation).
• File System: Unexpected new files (e.g., web shells) written to the WordPress uploads or plugin directories if LFI is chained with a file upload vulnerability.

The vendor has released version 3.1 of the Kentha Elementor Widgets plugin, which patches this vulnerability. Site administrators should update the plugin to version 3.1 or later immediately via the WordPress admin dashboard or by downloading the patched version from the plugin repository. If an immediate update is not possible, consider disabling the plugin or restricting Contributor/Developer role access until the patch can be applied. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

Wordfence included this vulnerability in its weekly WordPress vulnerability report for January 19–25, 2026, providing broader community visibility (Wordfence Blog). The vulnerability was also noted on Bluesky via the CVE tracking account and indexed by multiple vulnerability aggregators shortly after disclosure, indicating routine community awareness without significant alarm given its low exploitation probability.