What is the CVSS score of CVE-2026-39538?

CVE-2026-39538 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-39538?

The Mikado Core WordPress plugin (version 1.6 and earlier) contains a local file inclusion vulnerability that allows authenticated users with low-privilege accounts to read sensitive files from the…

How to fix or mitigate CVE-2026-39538?

Within 24 hours: Inventory all WordPress installations using Mikado Core plugin and document current version numbers. Within 7 days: Disable or remove Mikado Core plugin from all affected WordPress sites until a patched version is available; if plugin functionality is critical, restrict user registrations and audit existing user accounts for suspicious activity. Within 30 days: Monitor Patchstack and Mikado Core vendor channels for patch release; establish a process to apply updates within 48 hours of availability. If continued plugin use is mandatory, implement Web Application Firewall rules to monitor and block suspicious file inclusion patterns.

PHP CVE-2026-39538

EUVD-2026-20193 HIGH

PHP Remote File Inclusion (CWE-98)

2026-04-08 Patchstack

GHSA-c523-5gm5-4mr8

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 15:22 vuln.today

CVSS changed

Apr 14, 2026 - 15:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20193

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Mikado Core mikado-core allows PHP Local File Inclusion.This issue affects Mikado Core: from n/a through <= 1.6.

AnalysisAI

Local File Inclusion in Mikado Core WordPress plugin (≤1.6) allows authenticated remote attackers to read arbitrary files on the server via improper filename control in PHP include/require statements. Despite a 7.5 CVSS score, real-world risk is limited by low-privilege authentication requirement (PR:L) and high attack complexity (AC:H). EPSS exploitation probability is minimal (0.05%, 17th percentile), with no public exploit identified at time of analysis. Reported by Patchstack, this CWE-98 vulnerability enables information disclosure and potential code execution if attackers chain it with file upload or log poisoning techniques.

Technical ContextAI

This is a CWE-98 PHP Remote/Local File Inclusion vulnerability in Mikado Core, a WordPress plugin by Mikado-Themes (CPE: cpe:2.3:a:mikado-themes:mikado_core:*:*:*:*:*:*:*:*). The flaw stems from improper validation of user-controlled input used in PHP include() or require() statements. When an application fails to sanitize file paths before passing them to these functions, attackers can manipulate the filename parameter to include local files (LFI) or, in some PHP configurations with allow_url_include enabled, remote files (RFI). In WordPress plugins, this typically occurs when handling template loading, dynamic module inclusion, or configuration file processing. The vulnerability allows reading sensitive files like wp-config.php, /etc/passwd, or application logs. If combined with file upload capabilities or log poisoning, attackers can achieve remote code execution by including attacker-controlled PHP code. The AC:H rating suggests the exploit requires specific conditions like particular PHP settings, file system permissions, or plugin configuration states.

RemediationAI

Upgrade Mikado Core to version 1.6.1 or later if available from the vendor (Mikado-Themes). Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mikado-core/vulnerability/wordpress-mikado-core-plugin-1-6-local-file-inclusion-vulnerability for specific patch details and release information. If no patched version exists, immediately disable or remove the Mikado Core plugin until a fix is released. As interim mitigation, restrict WordPress user registrations, audit existing low-privilege accounts, implement Web Application Firewall rules to detect path traversal patterns in requests, and ensure PHP configurations have allow_url_include disabled and open_basedir restrictions enabled to limit file system access scope. Monitor server logs for suspicious file access patterns targeting configuration files or unusual include paths.