STAGGS WordPress plugin: Remote code inclusion allows code execution

Summary

The STAGGS plugin for WordPress up to and including version 3.3.0 contains a code injection flaw (CWE-94) that allows Remote Code Inclusion. An unauthenticated remote attacker can make the application load and run code from an external source, which Patchstack describes as Remote Code Execution. Successful exploitation can lead to full compromise of the affected website, with a CVSS 3.1 base score of 10.0 (Critical). The exact vulnerable component and parameter are not publicly described in the sources.

Affected

• STAGGS WordPress plugin, all versions up to and including 3.3.0
• Versions from n/a through 3.3.0 according to the CVE record

Fixed in

• Version 3.4.0 (per Patchstack and the CVE record; not yet confirmed by the vendor)

Workaround

• No vendor-confirmed workaround.
• Deactivating or removing the plugin is the safe option if its functionality is not essential.
• A web application firewall or virtual patch can reduce exposure but is not a fix.

Exploitation

• No known exploitation in the wild as of 11 Nov 2026.
• Not listed in CISA KEV according to OffSeq.
• No public exploit code indexed in Metasploit or Exploit-DB.
• Patchstack expects exploitation and notes it could be used in mass-exploit campaigns.

Our recommendation

• Inventory all WordPress sites for the STAGGS plugin and record the installed version.
• If version 3.3.0 or below is installed, update to 3.4.0 or later as soon as possible; confirm the fixed version against the Patchstack advisory before rollout.
• If an update is not possible soon, deactivate the plugin.
• After patching or deactivating, check for unknown PHP files, modified core or plugin files, new admin users and unexpected outbound requests.
• Monitor the Patchstack advisory and the NVD entry for changes, as NVD status is Deferred.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  evenomn/CVE-2026-78287

Research sources

• Patchstack advisory for CVE-2026-78287 patchstack.com
• Patchstack STAGGS plugin page patchstack.com
• OffSeq radar entry for CVE-2026-78287 radar.offseq.com
• Patchstack STAGGS vulnerabilities list patchstack.com
• Wikipedia: File inclusion vulnerability en.wikipedia.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:21.