Field brief
Estatik plugin vulnerable to critical RFI, CVE‑2026‑125795
A critical remote file inclusion flaw in Estatik Estatik 4.3.6 is now publicly documented, but no vendor advisory has been issued.
The NVD lists CVE‑2026‑125795 as a critical PHP remote file inclusion vulnerability affecting Estatik Estatik up to version 4.3.6, with a CVSS score of 9.8. No vendor advisory has yet been published, and the CISA KEV database does not list this CVE. PatchStack indicates that version 4.3.7 includes the fix. Estatik users should upgrade to 4.3.7 or later to eliminate the risk. Keep an eye on the vendor’s security portal for an official advisory and apply the update promptly. For reference, see the NVD entry: CVE‑2026‑125795. This flaw allows an attacker to include arbitrary files on the server, potentially exposing sensitive data or enabling code execution. The high CVSS score reflects the severity of the issue. Users of Estatik 4.3.6 should immediately apply the patch to 4.3.7 to mitigate the risk. Monitor vendor announcements for any updates.
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.