What is the CVSS score of CVE-2026-39537?

CVE-2026-39537 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Mikado Core are affected by CVE-2026-39537?

Mikado Core, a WordPress plugin widely deployed on public-facing websites, contains a critical remote file exposure vulnerability (CVE-2026-39537, CVSS 8.1) that allows unauthenticated attackers to…

How to fix or mitigate CVE-2026-39537?

Within 24 hours: Disable Mikado Core plugin version 1.6 and earlier on all affected instances; deploy web application firewall rules to block local file inclusion (LFI) attack patterns; review server and web access logs for exploitation attempts. Within 7 days: Complete forensic analysis of logs to identify if the vulnerability was exploited; if the plugin is business-critical, implement additional compensating controls (restrictive file permissions, strict input validation rules). Within 30 days: Monitor the vendor's security advisory channel for patched releases; once a fixed version is confirmed available, validate in a test environment and deploy to production.

Mikado Core CVE-2026-39537

EUVD-2026-37672 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP WordPress Information Disclosure LFI Mikado Core Wordpress Plugin Mikado Themes

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H per reporter signals a non-trivial precondition; direct impact is file disclosure (C:H) with secondary I/A only via escalation, so I:L/A:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:24 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.

AnalysisAI

Unauthenticated local file inclusion in the Mikado Core WordPress plugin versions 1.6 and earlier allows remote attackers to include arbitrary local files via crafted HTTP requests, potentially exposing sensitive server contents and enabling code execution. CVSS 8.1 reflects high impact across confidentiality, integrity, and availability, though attack complexity is rated High. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Mikado Core is a PHP-based companion plugin distributed by Mikado Themes for WordPress, providing shared functionality across their commercial theme catalog. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement), commonly known as PHP Remote/Local File Inclusion, where user-controlled input flows into a PHP include/require statement without proper canonicalization or allow-listing. In WordPress plugin contexts, such flaws typically arise from AJAX handlers, template loader functions, or shortcode renderers that accept a file path or template name from request parameters and pass it to include without sanitization, enabling directory traversal to arbitrary .php files on the host filesystem.

RemediationAI

No vendor-released patched version is named in the available intelligence; administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mikado-core/vulnerability/wordpress-mikado-core-plugin-1-6-local-file-inclusion-vulnerability-2 and update Mikado Core to any release later than 1.6 once Mikado Themes publishes a fix, then validate via the WordPress plugin admin screen. As compensating controls until a patch is confirmed, deploy a WAF rule (e.g., Patchstack, Wordfence, or generic mod_security CRS rules 930100-930130) to block directory-traversal sequences (../, %2e%2e, encoded null bytes) targeting Mikado Core endpoints, restrict PHP open_basedir to the WordPress document root to limit which files an include can reach (trade-off: may break plugins that legitimately read outside webroot), and disable the plugin entirely if the dependent Mikado theme functionality is not business-critical (trade-off: theme features relying on Mikado Core will degrade).