What is the CVSS score of CVE-2026-39549?

CVE-2026-39549 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Aperitif WordPress Theme are affected by CVE-2026-39549?

The Aperitif WordPress theme (versions 1.5 and earlier) contains an unauthenticated remote file inclusion vulnerability that allows attackers to access sensitive files on any affected website without…

How to fix or mitigate CVE-2026-39549?

Within 24 hours: Conduct inventory of all WordPress instances using Aperitif theme (versions ≤1.5) and assess criticality; consider temporarily disabling the theme or taking affected sites offline if no immediate alternative theme is available. Within 7 days: Establish daily monitoring of elated-themes security channels and advisories for patch announcements; begin testing and evaluation of alternative WordPress themes as replacements. Within 30 days: Complete migration of all affected instances to an alternative theme, or deploy patched version of Aperitif (minimum version >1.5) immediately upon release from elated-themes and validate all site functionality.

Aperitif WordPress Theme CVE-2026-39549

EUVD-2026-37477 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Aperitif

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Remote unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects the specific parameter/traversal precondition; primary impact is file disclosure (C:H), with I/A only via secondary chains, hence I:L/A:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:38 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.

AnalysisAI

Unauthenticated local file inclusion in the Aperitif WordPress theme (versions up to and including 1.5) by elated-themes allows remote attackers to coerce the PHP include/require chain into loading attacker-controlled paths without credentials or user interaction. No public exploit identified at time of analysis, but the high CIA impact and unauthenticated network reach make it a meaningful supply-chain risk for sites using this commercial theme. The CVSS:3.1 score of 8.1 reflects high attack complexity, indicating the trigger likely requires a specific request pattern rather than a single trivial payload.

Technical ContextAI

The flaw is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), the canonical PHP file-inclusion weakness in which user-controlled input is passed into include/require/include_once/require_once without sufficient sanitization or whitelist enforcement. Aperitif is a commercial WordPress theme published by elated-themes (CPE cpe:2.3:a:elated-themes:aperitif), so the vulnerable code runs inside the WordPress request lifecycle - typically through a theme template loader, AJAX action, or query-parameter-driven dispatcher. Because the include is local-file-inclusion rather than remote, an attacker is constrained to files reachable on the server filesystem, but in a WordPress context that still exposes wp-config.php (database credentials and AUTH_KEY salts), arbitrary PHP files, and log files that can sometimes be poisoned for code execution.

RemediationAI

No vendor-released patch version is identified in the available data - the Patchstack record only enumerates affected versions ≤1.5 without naming a fixed release, so administrators should monitor the elated-themes ThemeForest/vendor page and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/aperitif/vulnerability/wordpress-aperitif-theme-1-5-local-file-inclusion-vulnerability) for an updated build above 1.5 and upgrade as soon as it is published. Until a fix is shipped, deactivate and replace the Aperitif theme on production sites, or place a WAF rule (Patchstack, Wordfence, or equivalent) in front of WordPress that blocks path-traversal sequences (../, encoded %2e%2e, null bytes, php://, file://) on theme endpoints and AJAX actions registered by the theme; the trade-off is that overly broad rules can break legitimate template parameters, so tune on a staging copy first. As a hardening compensating control, set open_basedir and disable allow_url_include in php.ini and restrict the web user's read access to wp-config.php via filesystem ACLs so that even successful inclusion yields less sensitive content.