On this page
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Weakness Summary
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
- Canonical source: MITRE CWE-98 (opens in a new tab)
- Published Atomicorp CVE observations: 34
- Distinct affected products in those observations: 33
- Active Atomicorp rules associated with this weakness: 39
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2023-3452 | WordPress Canto Plugin <= 3.0.4 - File Inclusion | canto | Protected by Atomicorp rules | 340077 , 340694 , 340695 |
| CVE-2023-5815 | News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion | news & blog designer pack | Protected by Atomicorp rules | 340748 , 347006 |
| CVE-2023-6989 | Shield Security WP Plugin <= 18.5.9 - Local File Inclusion | shield security | Protected by Atomicorp rules | 340748 |
| CVE-2024-10571 | Chartify – WordPress Chart Plugin < 2.9.6 - Local File Inclusion | chartify | Protected by Atomicorp rules | 340748 , 347006 |
| CVE-2024-12209 | WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion | wp-umbrella | Protected by Atomicorp rules | 344360 , 347009 , 390709 |
| CVE-2024-9193 | WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update | whmcs | Protected by Atomicorp rules | 340087 , 340748 , 344370 , 347006 , 390720 |
| CVE-2026-0926 | Prodigy Commerce <= 3.3.0 - Local File Inclusion | Prodigy Commerce | Protected by Atomicorp rules | 344360 |
| CVE-2026-12227 | Visual Composer <= 45.16.0 - Unauthenticated LFI | visualcomposer | Protected by Atomicorp rules | 344360 , 347009 , 390709 |
| CVE-2016-20101 | Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php | Issuu Panel | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-39353 | InvoicePlane: Remote Code Execution via Writable Templates Directory | InvoicePlane | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2023-49084 | Cacti RCE via SQLi in pollers.php | cacti | Protected by Atomicorp rules | 340006 , 340007 , 340016 , 340017 , 340029 , 340095 , 340145 , 340156 , 340157 , 340159 , 341245 , 344360 , 344366 , 344370 , 347009 , 360147 , 360148 , 360152 , 380026 , 390709 , 390719 |
| CVE-2024-8252 | WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion | clean login | Protected by Atomicorp rules | 344360 |
| CVE-2025-32614 | EventON Lite <= 2.4 - Authenticated Local File Inclusion | flavor | Protected by Atomicorp rules | 344360 , 377360 , 390709 |
| CVE-2026-87927 | MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher | MaxSite CMS | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-49954 | Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory | Discuz! X5.0 | Protected by Atomicorp rules | 344360 |
| CVE-2017-14095 | Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control | smart protection server | Protected by Atomicorp rules | 330791 , 340007 , 340152 |
| CVE-2025-48157 | WordPress Formality Plugin <= 1.5.9 - Local File Inclusion | Formality | Protected by Atomicorp rules | 344360 , 347009 , 382238 , 390709 |
| CVE-2025-9990 | WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion | WordPress Helpdesk Integration | Protected by Atomicorp rules | 340748 , 344360 , 347006 , 347009 , 390709 |
| CVE-2026-104995 | BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'aja | BP Profile Search | Protected by Atomicorp rules | 340006 , 344360 , 390709 |
| CVE-2026-87902 | WordPress Core - PHP Template Path Traversal | WordPress | Protected by Atomicorp rules | 340007 |
| CVE-2026-44239 | FreePBX: Authenticated Local File Inclusion in Dashboard Module | freepbx | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11704 | Elegance Menu <= 1.9 - Authenticated (Contributor+) Local File Inclusion | Elegance Menu | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-50547 | InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier | InvoicePlane | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-92174 | SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter | SiteOrigin Widgets Bundle | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2015-10133 | WordPress Subscribe Comments File Read Vulnerability | subscribe to comments | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-39387 | BoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter | boidcms | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-71426 | GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field | GetSimpleCMS-CE | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-25760 | Joomla! Component Easy Shop 1.2.3 Local File Inclusion | easy shop | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-50954 | WordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusion | cab-fare-calculator | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11977 | HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion | Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms | Protected by Atomicorp rules | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-14280 | Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys | Events Manager – Calendar, Bookings, Tickets, and more! | Protected by Atomicorp rules | 340748 , 344360 , 347006 |
| CVE-2026-30480 | LibreNMS 22.11.0-23-gd091788f2 Path Traversal Vulnerability | LibreNMS 22.11.0-23-gd091788f2 | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-34787 | Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter | emlog | Protected by Atomicorp rules | 344360 , 347009 |
| CVE-2026-63302 | Local File Inclusion in Quick.CMS | Quick.CMS | Protected by Atomicorp rules | 344360 , 347009 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 330791 | Active | disruptive (deny) |
| 340006 | Active | disruptive (deny) |
| 340007 | Active | disruptive (deny) |
| 340014 | Active | disruptive (deny) |
| 340016 | Active | disruptive (deny) |
| 340017 | Active | disruptive (deny) |
| 340023 | Active | disruptive (deny) |
| 340029 | Active | disruptive (deny) |
| 340077 | Active | disruptive (deny) |
| 340087 | Active | disruptive (deny) |
| 340095 | Active | disruptive (deny) |
| 340145 | Active | disruptive (deny) |
| 340152 | Active | disruptive (deny) |
| 340156 | Active | disruptive (deny) |
| 340157 | Active | disruptive (deny) |
| 340159 | Active | disruptive (deny) |
| 340193 | Active | disruptive (deny) |
| 340694 | Active | disruptive (deny) |
| 340695 | Active | disruptive (deny) |
| 340748 | Active | disruptive (deny) |
| 341245 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 344361 | Active | disruptive (deny) |
| 344363 | Active | disruptive (deny) |
| 344364 | Active | disruptive (deny) |
| 344366 | Active | disruptive (deny) |
| 344370 | Active | disruptive (deny) |
| 347006 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 360147 | Active | disruptive (deny) |
| 360148 | Active | disruptive (deny) |
| 360152 | Active | disruptive (deny) |
| 377360 | Active | non-disruptive (pass) |
| 380026 | Active | disruptive (deny) |
| 382238 | Active | disruptive (deny) |
| 390709 | Active | disruptive (deny) |
| 390719 | Active | disruptive (deny) |
| 390720 | Active | disruptive (deny) |
| 393655 | Active | disruptive (deny) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims: