CVE-2026-11426

The UnderConstructionPage PRO WordPress plugin contains a security flaw that allows attackers with Subscriber-level access or higher to access sensitive data by exploiting a weakness in how the plugin handles file paths. Specifically, an attacker can specify any local file path when using the template_thumbnail parameter, causing the plugin to copy its contents into a publicly accessible location on the server. This vulnerability affects all versions of the plugin up to and including 5.76.

Based on public CVE data (MITRE/NVD).