What is the CVSS score of CVE-2026-39552?

CVE-2026-39552 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Blueprint WordPress Theme are affected by CVE-2026-39552?

Code Supply Co. Blueprint WordPress theme versions prior to 1.1.5 contain a vulnerability allowing unauthenticated attackers to read sensitive files from affected servers, including database…. A patch is available.

How to fix or mitigate CVE-2026-39552?

Within 24 hours: Inventory all WordPress installations and identify servers running Blueprint theme versions prior to 1.1.5; disable the theme or migrate to an alternative immediately. Within 7 days: Deploy Web Application Firewall rules to block file path traversal patterns in theme-related requests; enable comprehensive logging of file access attempts. Within 30 days: Implement filesystem-level access controls restricting web server processes to essential directories only; establish continuous monitoring of vendor advisories for patch availability.

Blueprint WordPress Theme CVE-2026-39552

EUVD-2026-33915 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-02 audit@patchstack.com

GHSA-pw35-mfxv-755m

LFI Information Disclosure PHP

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 02, 2026 - 16:01 EUVD

Analysis Generated

Jun 02, 2026 - 14:34 vuln.today

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion.

This issue affects Blueprint: from n/a before 1.1.5.

AnalysisAI

Local File Inclusion in Code Supply Co. Blueprint WordPress theme versions prior to 1.1.5 allows remote unauthenticated attackers to include arbitrary local PHP files through improper filename validation in include/require statements. CVSS rates the issue 8.1 (High) with high attack complexity, and no public exploit has been identified at time of analysis. Despite the CWE-98 classification suggesting Remote File Inclusion, the vendor advisory explicitly scopes the impact to Local File Inclusion.

Technical ContextAI

Blueprint is a commercial WordPress theme distributed by Code Supply Co., implemented in PHP and running within the WordPress request lifecycle. CWE-98 (Improper Control of Filename for Include/Require Statement) describes a class of bug where attacker-controllable input is passed into PHP language constructs such as include, require, include_once, or require_once without adequate sanitization or allowlisting. In a WordPress theme context this typically manifests through a template loader, shortcode handler, AJAX endpoint, or query parameter that resolves a filename relative to the theme or WordPress root. Because PHP's stream wrappers treat traversal sequences (../) and absolute paths uniformly, an unsanitized variable can be coerced into loading sensitive PHP source or configuration files, with their contents executed in the WordPress process context.

RemediationAI

Upgrade Blueprint to version 1.1.5 or later, which is the vendor-released patch identified in the Patchstack advisory (https://patchstack.com/database/wordpress/theme/blueprint/vulnerability/wordpress-blueprint-theme-1-1-5-local-file-inclusion-vulnerability); this is the only sanctioned fix. If immediate upgrade is not possible, deactivate and switch away from the Blueprint theme until patching is feasible - this fully removes exposure but breaks the site's presentation layer. As a compensating control, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to block requests carrying path-traversal sequences ('../', encoded variants, and absolute paths like '/etc/') against theme endpoints, accepting the risk that bespoke parameter names may evade generic signatures. Hardening php.ini with open_basedir scoped to the WordPress document root and confirming allow_url_include=Off limits the blast radius of any successful inclusion and prevents escalation to remote file inclusion, at the cost of some plugin compatibility issues.