What is the CVSS score of CVE-2026-39558?

CVE-2026-39558 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Malmö WordPress Theme are affected by CVE-2026-39558?

The Malmö WordPress theme (versions 2.2 and earlier) contains an unauthenticated file inclusion vulnerability allowing remote attackers to read sensitive server files and potentially execute code on…

How to fix or mitigate CVE-2026-39558?

24 hours: Inventory all WordPress instances for Malmö theme v2.2 or earlier; immediately deactivate or remove theme from non-critical production sites pending mitigation. 7 days: Complete removal of vulnerable theme from all production WordPress installations; deploy WAF rules to block path traversal patterns; migrate sites to alternative themes. 30 days: Implement automated theme version scanning and alerting; establish policy prohibiting third-party themes without active security maintenance records.

Malmö WordPress Theme CVE-2026-39558

EUVD-2026-37675 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Malm

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects non-trivial conditions; high confidentiality, but integrity and availability impact only realistic if LFI is chained to RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:23 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.

AnalysisAI

Unauthenticated local file inclusion in the Malmö WordPress theme versions 2.2 and earlier allows remote attackers to include arbitrary local files via crafted requests, enabling disclosure of sensitive server-side content and potentially remote code execution. The flaw is reported by Patchstack and classified as CWE-98 (improper control of filename for include/require), with no public exploit identified at time of analysis. Affected sites are WordPress installations using the elated-themes Malmö theme.

Technical ContextAI

The vulnerability resides in a PHP include/require statement within the Malmö WordPress theme (CPE cpe:2.3:a:elated-themes:malmö) where user-controllable input is used to construct a filesystem path without sufficient sanitization. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion') indicates the affected code path likely passes attacker-supplied data into include(), require(), or similar functions. In a WordPress theme context this typically manifests as a theme template loader, AJAX handler, or query parameter that selects a file to render, where path traversal sequences or absolute paths reach the include sink.

RemediationAI

No vendor-released patch identified at time of analysis from the provided references - the only cited source is the Patchstack database entry at https://patchstack.com/database/wordpress/theme/malmo/vulnerability/wordpress-malmoe-theme-2-2-local-file-inclusion-vulnerability, which should be consulted for an updated fix version once published by elated-themes. Until a patched theme version is confirmed, operators should deactivate the Malmö theme and switch to a maintained alternative (this will break the site's existing presentation), or place the site behind a WAF with rules blocking path-traversal sequences (../, encoded variants) and absolute paths in query parameters routed to theme endpoints (rules may produce false positives on legitimate theme requests). Restricting the WordPress installation with PHP open_basedir and ensuring file permissions prevent reading of wp-config.php by the webserver user reduces the impact of any successful inclusion.