Summary
CVE-2026-28150 is an unauthenticated Local File Inclusion (LFI) vulnerability in the Golo Framework WordPress plugin (developed by uxper), affecting all versions prior to 1.7.5. The flaw stems from improper control of filenames used in PHP include/require statements, allowing a remote, unauthenticated attacker to include and access arbitrary local files on the server. The vulnerability carries a CVSS v3.1 base score of 8.1 (High).
Technical details
- Root cause: Improper control of filename input used in a PHP
include/requirestatement (CWE-98), allowing attacker-supplied path data to influence which file is loaded by the plugin. - Trigger conditions: No authentication or user interaction is required; an attacker only needs network access to a WordPress site running a vulnerable Golo Framework plugin version.
- Attack vector: Network (remote), with high attack complexity per the CVSS vector.
- Impact: Successful exploitation can expose the contents of arbitrary local files accessible to the web server process, and depending on server configuration may lead to further compromise of confidentiality, integrity, and availability of the affected site.
Affected software
- Golo Framework (WordPress plugin by uxper): all versions prior to 1.7.5
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Update the Golo Framework plugin to version 1.7.5 or later, where the filename-handling issue has been addressed.
- If immediate patching is not possible: Restrict or monitor direct external access to the plugin’s PHP endpoints at the web server or WAF layer, and review server logs for anomalous file-path parameters in requests targeting the plugin.

