CVE-2026-24538: 
WordPress vulnerability analysis and mitigation

CVE-2026-24538 is a Local File Inclusion (LFI) vulnerability in the Omnipress WordPress plugin, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Omnipress plugin up to and including 1.6.7, developed by omnipressteam. The vulnerability was reported by researcher theviper17 on December 25, 2025, and publicly disclosed by Patchstack on January 23–24, 2026. It carries a CVSS v3.1 base score of 7.5 (High), as assigned by Patchstack (Patchstack).

The vulnerability stems from improper validation of user-supplied input used in PHP file include/require statements (CWE-98), allowing an attacker to manipulate the filename parameter to include arbitrary local files from the server's filesystem. Exploitation requires the attacker to be authenticated with at least Contributor or Developer-level privileges on the WordPress site, and the attack complexity is rated High, indicating that specific conditions must be met. The flaw is classified under OWASP Top 10 category A3: Injection, and is mapped to CAPEC-193 (PHP Remote File Inclusion). No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which may contain database credentials. This could lead to complete database takeover, exposure of authentication secrets, and potential for further lateral movement within the hosting environment. Confidentiality, integrity, and availability are all rated as High impact in the CVSS scoring (Patchstack).

As of the time of disclosure, no official patch is available for the Omnipress plugin, and Patchstack notes the vulnerability has a low priority impact rating with limited likelihood of exploitation in the short term. The EPSS score is approximately 0.124%, indicating a low probability of exploitation in the near term. No in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported. The vulnerability was detected by Qualys (detection ID 530898) and is noted as potentially usable in mass-exploit campaigns targeting WordPress sites (Patchstack, Feedly).

As of the disclosure date, no official patched version of the Omnipress plugin is available. Site administrators are advised to deactivate and remove the Omnipress plugin until a patched version is released. Restricting Contributor and Developer role assignments to trusted users can reduce the attack surface. Hosting providers or web developers should be consulted if immediate removal is not feasible. Patchstack's virtual patching service can provide interim mitigation for subscribers (Patchstack).

Wordfence included CVE-2026-24538 in its weekly WordPress vulnerability report for January 19–25, 2026, highlighting it among other plugin vulnerabilities tracked that week (Wordfence). The vulnerability was also noted by The Hacker Wire and shared on Bluesky social media, indicating modest community awareness. No significant vendor statements or major media coverage beyond routine vulnerability reporting have been identified.