CVE-2026-4280 Details

A local file inclusion vulnerability has been identified in the Breaking News WP plugin for WordPress, affecting all versions through 1.3. The issue arises from the brnwp_ajax_form AJAX endpoint, which lacks proper authorization checks and CSRF protection. Additionally, the plugin fails to adequately validate file paths when the brnwp_theme option is passed to an include() statement within the brnwp_show_breaking_news_wp() shortcode handler. Although user input is sanitized, the sanitation does not remove directory traversal sequences, allowing authenticated attackers with Subscriber-level access or higher to exploit the vulnerability. By overwriting the brnwp_theme option with a crafted payload that includes directory traversal sequences, these attackers can include arbitrary files from the server when the shortcode is used.