First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-66657

HighCVSS 8.1/10Last modified Oct 24, 2026

Description

Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Mikado-Themes	Biagiotti Core	<= 2.1.1

References

https://patchstack.com/database/wordpress/plugin/biagiotti-core/vulnerability/wordpress-biagiotti-core-plugin-2-1-1-local-file-inclusion-vulnerability?_s_id=cve

Timeline

Published: Aug 13, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-666588.5Subscriber SQL Injection in Reviewer <= 3.14.2 versions.CVE-2026-666599.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind S CVE-2026-66667.5A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE fie CVE-2026-666606.5Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.CVE-2026-666617.7Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.CVE-2026-666629.8Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-666637.1Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.CVE-2026-666647.1Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.CVE-2026-6666510.0Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.CVE-2026-666666.9Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue CVE-2026-666677.1Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.CVE-2026-666688.5Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.

CVE-2026-66657: High severity, CVSS 8.1 | Vulnix