What is the CVSS score of CVE-2026-39553?

CVE-2026-39553 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WaveRide WordPress Theme are affected by CVE-2026-39553?

The Select-Themes WaveRide WordPress theme (versions up to 1.4) contains a Local File Inclusion vulnerability allowing unauthenticated remote attackers to include arbitrary PHP files and execute…

How to fix or mitigate CVE-2026-39553?

Within 24 hours: Identify all WordPress instances running Select-Themes WaveRide versions ≤1.4; disable or uninstall the vulnerable theme immediately. Within 7 days: Deploy alternative WordPress theme and conduct functional testing. Within 30 days: Monitor Select-Themes vendor advisories for patch release and apply immediately upon availability.

WaveRide WordPress Theme CVE-2026-39553

EUVD-2026-33916 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-02 audit@patchstack.com

GHSA-hfjv-pq6h-6ffm

LFI Information Disclosure PHP

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 14:35 vuln.today

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion.

This issue affects WaveRide: from n/a through 1.4.

AnalysisAI

Local File Inclusion in Select-Themes WaveRide WordPress theme versions up to and including 1.4 allows remote attackers to coerce the application into including arbitrary local PHP files via improper validation of a filename used in an include/require statement. The flaw is rated CVSS 8.1 (high) with network attack vector and no authentication required, though high attack complexity tempers exploitability; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-98 (Improper Control of Filename for Include/Require Statement) issue, the canonical PHP RFI/LFI class, occurring when user-controlled input flows into PHP's include, include_once, require, or require_once language constructs without adequate normalization or allowlisting. WaveRide is a commercial WordPress theme distributed by Select-Themes, and like many premium themes it likely exposes a template-loading or AJAX endpoint (commonly admin-ajax.php or a theme-specific PHP handler) where a path parameter is concatenated into an include statement. Although the CWE class historically permits both Remote File Inclusion and Local File Inclusion, modern PHP defaults (allow_url_include=Off) restrict practical exploitation to LFI, which is consistent with the description and the 'LFI' tag.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory documents the issue but the available data does not list a specific fixed WaveRide version, so administrators should monitor https://patchstack.com/database/wordpress/theme/waveride/vulnerability/wordpress-waveride-theme-1-4-local-file-inclusion-vulnerability and the Select-Themes vendor channel for an update beyond 1.4. As compensating controls, deploy a WordPress WAF such as Patchstack, Wordfence, or a generic ModSecurity ruleset to block path-traversal payloads (../, encoded variants, null bytes) targeting theme PHP endpoints; restrict open_basedir in php.ini to the WordPress webroot to constrain which files the include statement can reach, accepting that this may break plugins reading from /tmp or shared paths; and as a last resort switch to a different theme, noting that this changes site appearance and may require re-doing theme customizations. Auditing access logs for unusual query parameters containing 'file=', 'page=', or path traversal sequences hitting wp-content/themes/waveride/ is recommended pending a fix.