What is the CVSS score of CVE-2026-39559?

CVE-2026-39559 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Uppercase Theme are affected by CVE-2026-39559?

The CodeSupply Co. Uppercase WordPress theme (versions before 1.2.2) contains a local file inclusion vulnerability enabling unauthenticated attackers to access and disclose sensitive files including…

How to fix or mitigate CVE-2026-39559?

24 hours: Inventory all WordPress installations using Uppercase theme versions prior to 1.2.2 and assess exposure scope. 7 days: Either deactivate the Uppercase theme and deploy an alternative maintained theme, or implement Web Application Firewall rules to block file path traversal requests. 30 days: Monitor CodeSupply Co. advisories for patch release; immediately upgrade to Uppercase 1.2.2 or later upon availability.

Uppercase Theme CVE-2026-39559

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP WordPress Information Disclosure LFI Uppercase Wordpress Theme Codesupplyco

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H because attacker must discover the vulnerable parameter; high confidentiality, limited integrity via log poisoning, no direct availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:35 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.

AnalysisAI

Local File Inclusion in the CodeSupply Co. 'Uppercase' WordPress theme versions prior to 1.2.2 allows remote unauthenticated attackers to include and disclose arbitrary local files from the web server, potentially leading to source code disclosure, credential theft, or remote code execution where log/upload poisoning is feasible. The flaw is tagged as LFI/PHP/Information Disclosure by Patchstack and carries a CVSS 8.1 (High) rating; no public exploit identified at time of analysis.

Technical ContextAI

The affected component is the 'Uppercase' commercial WordPress theme published by CodeSupply Co. (CPE: cpe:2.3:a:codesupplyco:uppercase:*). The weakness is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program, a.k.a. PHP Remote File Inclusion). In practice this means a PHP include()/require() call in the theme accepts attacker-controlled input - typically a request parameter referencing a template, page, or view - without sufficient allow-listing or path normalization, so traversal sequences or arbitrary file paths resolve to files outside the intended template directory. Because WordPress themes execute in the same PHP context as core, any LFI primitive can read files such as wp-config.php (database credentials, auth keys), /etc/passwd, or session/log files.

RemediationAI

Vendor-released patch: upgrade the Uppercase theme to version 1.2.2 or later via the WordPress admin Themes updater or by replacing the theme directory with the patched release; advisory details are at https://patchstack.com/database/wordpress/theme/uppercase/vulnerability/wordpress-uppercase-theme-1-2-2-local-file-inclusion-vulnerability. If immediate patching is not possible, deactivate and switch off the Uppercase theme (side effect: site appearance reverts to the fallback theme), or place a WAF/ModSecurity rule in front of WordPress that blocks requests containing path-traversal sequences (../, %2e%2e, null bytes) and absolute paths in query parameters bound for theme PHP files (side effect: may break legitimate theme features that pass file or template names in the URL). Additionally restrict PHP open_basedir to the WordPress document root to contain file reads, and rotate wp-config.php secrets (AUTH_KEY, DB password) if exposure is suspected.