What is the CVSS score of CVE-2026-39538?

CVE-2026-39538 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-39538?

The Mikado Core WordPress plugin (version 1.6 and earlier) contains a local file inclusion vulnerability that allows authenticated users with low-privilege accounts to read sensitive files from the…

PHP CVE-2026-39538

Q: How to fix or mitigate CVE-2026-39538?

Within 24 hours: Inventory all WordPress installations using Mikado Core plugin and document current version numbers. Within 7 days: Disable or remove Mikado Core plugin from all affected WordPress sites until a patched version is available; if plugin functionality is critical, restrict user registrations and audit existing user accounts for suspicious activity. Within 30 days: Monitor Patchstack and Mikado Core vendor channels for patch release; establish a process to apply updates within 48 hours of availability. If continued plugin use is mandatory, implement Web Application Firewall rules to monitor and block suspicious file inclusion patterns.

EUVD-2026-20193 HIGH

PHP Remote File Inclusion (CWE-98)

2026-04-08 Patchstack

GHSA-c523-5gm5-4mr8

PHP Information Disclosure LFI

7.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 15:22 vuln.today

CVSS changed

Apr 14, 2026 - 15:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20193

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionNVD

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Mikado Core mikado-core allows PHP Local File Inclusion.This issue affects Mikado Core: from n/a through <= 1.6.

AnalysisAI

Local File Inclusion in Mikado Core WordPress plugin (≤1.6) allows authenticated remote attackers to read arbitrary files on the server via improper filename control in PHP include/require statements. Despite a 7.5 CVSS score, real-world risk is limited by low-privilege authentication requirement (PR:L) and high attack complexity (AC:H). …

RemediationAI

Within 24 hours: Inventory all WordPress installations using Mikado Core plugin and document current version numbers. Within 7 days: Disable or remove Mikado Core plugin from all affected WordPress sites until a patched version is available; if plugin functionality is critical, restrict user registrations and audit existing user accounts for suspicious activity. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-39538 vulnerability details – vuln.today

Back

PHP CVE-2026-39538

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code