CVE-2026-4280: 
WordPress vulnerability analysis and mitigation

CVE-2026-4280 is a Local File Inclusion (LFI) vulnerability in the Breaking News WP plugin for WordPress, affecting all versions up to and including 1.3. The flaw allows authenticated attackers with Subscriber-level access or higher to include arbitrary files from the server via directory traversal. It was published on April 22, 2026, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The brnwp_ajax_form AJAX endpoint lacks both authorization checks and CSRF verification, allowing any authenticated user to overwrite the brnwp_theme WordPress option. Although sanitize_text_field() is applied to user input, it does not strip directory traversal sequences (../), so an attacker can set the option to a payload such as ../../../../etc/passwd. When a page containing the [breaking-news-wp] shortcode is rendered, the brnwp_show_breaking_news_wp() handler passes the poisoned option value directly to PHP's include() statement, triggering inclusion of the attacker-specified file (GitHub Advisory, Wordfence). Vulnerable code is visible at lines 85, 366, and 372 of breaking-news.php in the plugin repository (Plugin Source L85).

Successful exploitation allows an authenticated attacker with minimal privileges (Subscriber role) to read arbitrary files on the server, including sensitive system files such as /etc/passwd, WordPress configuration files (e.g., wp-config.php containing database credentials), and other application secrets. The primary impact is a high confidentiality loss; integrity and availability are not directly affected by this vulnerability. Exposure of database credentials or secret keys could enable further compromise, including full WordPress site takeover or lateral movement within the hosting environment (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.093% (0.164% per GitHub Advisory), placing it in the 37th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the Breaking News WP plugin version ≤ 1.3 by inspecting plugin directories (/wp-content/plugins/breaking-news-wp/) or using tools like WPScan.
2. Authenticate: Obtain or register a low-privilege WordPress account (Subscriber role or above) on the target site.
3. Overwrite the theme option: Send an authenticated POST request to the brnwp_ajax_form AJAX endpoint (e.g., POST /wp-admin/admin-ajax.php?action=brnwp_ajax_form) with a directory traversal payload as the theme value, such as brnwp_theme=../../../../etc/passwd. Because the endpoint lacks authorization and CSRF checks, this request succeeds for any authenticated user.
4. Trigger file inclusion: Navigate to or request any page on the site that renders the [breaking-news-wp] shortcode. The brnwp_show_breaking_news_wp() handler reads the poisoned brnwp_theme option and passes it to include(), causing the server to include and output the contents of the targeted file.
5. Exfiltrate sensitive data: Review the page response for the contents of the included file (e.g., /etc/passwd, wp-config.php) to harvest credentials or system information for further exploitation (GitHub Advisory, Wordfence).

• Network: Authenticated POST requests to /wp-admin/admin-ajax.php with action=brnwp_ajax_form and a brnwp_theme parameter containing ../ sequences; unusual GET requests to pages rendering the [breaking-news-wp] shortcode shortly after such POST requests.
• Logs: WordPress access logs showing repeated AJAX calls to admin-ajax.php with traversal strings (e.g., ../../../../etc/passwd) in POST body; PHP error logs referencing unexpected file paths in include() calls within breaking-news.php.
• Database: The brnwp_theme entry in the WordPress wp_options table set to a value containing ../ directory traversal sequences rather than a valid theme name.
• File System: No direct file writes are expected from LFI alone, but monitor for unexpected file creation if the server's PHP configuration allows remote or chained inclusion.

Users should update the Breaking News WP plugin to a version beyond 1.3 that addresses this vulnerability; the patch was noted as available as of April 22, 2026 (GitHub Advisory). As an immediate workaround, administrators should disable or deactivate the plugin until patching is complete, and restrict Subscriber-level user registration if not required. Additionally, implement a Web Application Firewall (WAF) rule to block POST requests to admin-ajax.php containing directory traversal sequences, and audit the brnwp_theme option in the WordPress database for any suspicious values (Wordfence).

Wordfence included CVE-2026-4280 in their weekly WordPress vulnerability report for April 20–26, 2026, highlighting it as part of their routine plugin security monitoring (Wordfence Weekly Report). No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregator listings.