What is the CVSS score of CVE-2026-39544?

CVE-2026-39544 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-39544?

CVE-2026-39544 affects themeStek LabtechCO WordPress theme through version 8.3, enabling authenticated users with low privileges to read arbitrary files from the web server.

How to fix or mitigate CVE-2026-39544?

Within 24 hours: audit all WordPress installations for themeStek LabtechCO theme presence and version (check /wp-content/themes/ directories and wp_options table for active theme). Within 7 days: if running affected versions (≤8.3), migrate to an alternative theme or contact themeStek for guidance on unofficial patches; restrict administrative and contributor roles to trusted personnel only. Within 30 days: establish a WordPress plugin/theme inventory and patch management process to prevent future exploitation of similar vulnerabilities.

PHP CVE-2026-39544

EUVD-2026-20202 HIGH

PHP Remote File Inclusion (CWE-98)

2026-04-08 Patchstack

GHSA-2j6r-34xw-23mj

PHP Information Disclosure LFI

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:40 vuln.today

CVSS changed

Apr 14, 2026 - 19:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20202

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek LabtechCO labtechco allows PHP Local File Inclusion.This issue affects LabtechCO: from n/a through <= 8.3.

AnalysisAI

Local file inclusion in themeStek LabtechCO WordPress theme versions through 8.3 allows authenticated attackers with low privileges to read arbitrary files from the web server. Despite the CWE classification mentioning remote file inclusion, available data (tags, Patchstack categorization) confirms this is a local file inclusion vulnerability. EPSS score of 0.05% (17th percentile) indicates low observed exploitation probability in the wild, with no confirmed active exploitation (not in CISA KEV)

Technical ContextAI

This vulnerability stems from improper control of filename parameters in PHP include/require statements within the LabtechCO WordPress theme. CWE-98 represents a class of vulnerabilities where user-controlled input is used to construct file paths without adequate validation, sanitization, or restriction. In PHP applications, this typically occurs when variables are passed directly to functions like include(), require(), include_once(), or require_once() without properly filtering directory traversal sequences (../) or validating against an allowlist. The affected product is the LabtechCO theme (CPE: cpe:2.3:a:themestek:labtechco) developed by themeStek for WordPress installations. Local file inclusion vulnerabilities allow attackers to read sensitive files from the server filesystem, such as configuration files containing database credentials, application source code, or system files like /etc/passwd on Linux systems. While the CVE description mentions 'PHP Remote File Inclusion,' the actual vulnerability classification by Patchstack and associated tags confirm this is a local file inclusion (LFI) issue, which has different exploitation characteristics and does not permit execution of remotely-hosted malicious PHP code.

RemediationAI

The primary remediation is to upgrade the LabtechCO WordPress theme to a patched version beyond 8.3, though the specific fixed version number is not confirmed in available data at time of analysis. Site administrators should check with themeStek for the latest theme release that addresses CVE-2026-39544 and apply the update through the WordPress admin interface (Dashboard > Appearance > Themes > Update) or by manually uploading the updated theme files via FTP. As an interim workaround until patching is completed, administrators should audit and restrict WordPress user accounts to minimize the number of authenticated users with low-privilege access, review user roles to ensure principle of least privilege is enforced, and monitor web server access logs for suspicious file access patterns or directory traversal attempts. Web Application Firewall (WAF) rules can be implemented to detect and block common LFI attack patterns in HTTP requests, though this is a defense-in-depth measure and not a substitute for patching. Organizations should also review server file permissions to ensure sensitive configuration files are not world-readable and consider implementing PHP disable_functions directives to restrict dangerous file operations if not required by legitimate theme functionality. For detailed vulnerability information and patch guidance, consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/labtechco/vulnerability/wordpress-labtechco-theme-8-3-local-file-inclusion-vulnerability and the NIST NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-39544.