Atomic Edge analysis of CVE-2026-57647:
This vulnerability is a Local File Inclusion (LFI) flaw in the Panorama – 360 degree Virtual Tour plugin for WordPress, affecting versions up to and including 1.6.1. An authenticated attacker with contributor-level access or above can include and execute arbitrary PHP files from the server, leading to remote code execution, data exposure, or privilege escalation. The CVSS score is 7.5 (High).
The root cause lies in the absence of direct file access control in several block template files. The vulnerable files are located in the `panorama/blocks/` directory: `gallery.php`, `gstreet.php`, `image.php`, `image360.php`, `tour360.php`, and `video.php`. In the vulnerable version, these files execute PHP code directly when accessed, without first checking if WordPress has properly initialized or if the request is authorized. The files define block attributes using data from post meta (`$get_value`, `$bppiv_meta`) and output them without any permission validation. The patch adds an `ABSPATH` check at the top of each file (`if ( ! defined( ‘ABSPATH’ ) ) { exit; }`), which prevents direct access to these files outside the WordPress context. Additionally, the patch wraps the block-building code inside anonymous functions (`call_user_func( function() use ( … ) { … } )`), which prevents the code from executing as a standalone script.
To exploit this vulnerability, an attacker with contributor-level credentials can directly access the block template files via the web server. For example, navigating to `/wp-content/plugins/panorama/blocks/image.php` will cause the file to execute. Since the file uses `$get_value`, `$bppiv_meta`, and other variables derived from post meta, the attacker can craft a malicious post (e.g., a custom post type like `bppiv-image-viewer`) containing payloads in the relevant meta fields. By uploading a file (like a PHP shell disguised as a JPEG image) via the WordPress media library and then referencing its URL in the `bppiv_image_src` meta field, the attacker can achieve code execution when the block is rendered or when the PHP file is included. The file inclusion occurs because the block files directly embed URLs from meta into the output, and WordPress’s file inclusion mechanisms (like `include()` or `require()`) are not used; instead, the attacker exploits the fact that the PHP file itself will be executed as a script, and the meta values are evaluated in the process.
The patch addresses the vulnerability by adding a direct access check at the beginning of each block file: `if ( ! defined( ‘ABSPATH’ ) ) { exit; }`. This prevents the files from being executed when accessed directly via the web server. The patch also restructures the code within these files to use anonymous functions, which further isolates the execution context. Before the patch, the block array `$block` was defined in the global scope, making it executable on direct access. After the patch, the code is wrapped in an anonymous function that only executes when called from within the WordPress context. The same fix is applied to `panorama/admin/ads/submenu.php`, which also lacked the `ABSPATH` check.
If exploited, an attacker can achieve arbitrary PHP code execution on the server. This allows them to bypass access controls, steal sensitive data (such as database credentials, user information, and configuration files), install backdoors, or pivot to other systems on the network. Since the attacker only needs contributor-level access, this vulnerability poses a significant risk, especially in multi-author WordPress sites where contributors may not be fully trusted. The impact is critical because it can lead to complete site compromise.
