Uppercase Theme
CVE-2026-39559
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify WordPress site running Uppercase theme
-
DeliveryLocate vulnerable theme parameter
-
ExploitSend crafted HTTP request with path traversal
-
InstallPHP include reads wp-config.php
-
C2Extract DB credentials and auth keys
-
ExecuteAuthenticate as admin and upload backdoor
-
ImpactFull server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target WordPress site must have the CodeSupply Co. 'Uppercase' theme installed at a version below 1.2.2 and the vulnerable theme PHP entry point must be reachable over HTTP(S) without authentication. The CVSS AC:H indicates the attacker must identify the specific theme parameter or route that feeds user input into the PHP include/require sink, and must craft a path that resolves to a readable file under the PHP process's permissions (open_basedir, file system ACLs, and disable_functions all constrain what can be read or executed). No CSRF token, no admin login, and no user interaction are required (PR:N, UI:N), but the bug only triggers when the theme is active or the affected file is directly requestable in the WordPress installation. |
| Impact | Signals are mixed. CVSS 3.1 is 8.1 with AV:N/PR:N/UI:N (network, unauthenticated, no user interaction) and high CIA impact, which is severe, but AC:H signals that some non-trivial condition or knowledge is required to reach the vulnerable code path - consistent with needing to know a parameter name or theme route. The vulnerability is NOT in CISA KEV, no EPSS score was supplied, and there is no public POC referenced - only a Patchstack advisory record. Real-world risk is meaningful because WordPress themes are mass-deployed and LFI on WordPress frequently chains into wp-config.php disclosure and full site takeover, but exploitation likely requires reconnaissance of the specific parameter/endpoint rather than a spray-and-pray scan. Treat as high priority for sites running this theme, moderate priority in aggregate triage. |
| Exploit ScenarioDerived | An unauthenticated attacker enumerates WordPress sites running the Uppercase theme (e.g., via wp-content/themes/uppercase/ asset paths), then issues a crafted HTTP GET to a vulnerable theme endpoint with a traversal payload in the file/template parameter to read wp-config.php and exfiltrate database credentials and WordPress auth keys. With those, the attacker pivots to authenticated admin access, uploads a malicious plugin, and gains full RCE on the server. No public POC has been identified, so initial exploitation requires reverse-engineering the vulnerable parameter from the patched diff. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Local File Inclusion in the CodeSupply Co. 'Uppercase' WordPress theme versions prior to 1.2.2 allows remote unauthenticated attackers to include and disclose arbitrary local files from the web server, potentially leading to source code disclosure, credential theft, or remote code execution where log/upload poisoning is feasible. The flaw is tagged as LFI/PHP/Information Disclosure by Patchstack and carries a CVSS 8.1 (High) rating; no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade the Uppercase theme to version 1.2.2 or later via the WordPress admin Themes updater or by replacing the theme directory with the patched release; advisory details are at https://patchstack.com/database/wordpress/theme/uppercase/vulnerability/wordpress-uppercase-theme-1-2-2-local-file-inclusion-vulnerability. If immediate patching is not possible, deactivate and switch off the Uppercase theme (side effect: site appearance reverts to the fallback theme), or place a WAF/ModSecurity rule in front of WordPress that blocks requests containing path-traversal sequences (../, %2e%2e, null bytes) and absolute paths in query parameters bound for theme PHP files (side effect: may break legitimate theme features that pass file or template names in the URL). Additionally restrict PHP open_basedir to the WordPress document root to contain file reads, and rotate wp-config.php secrets (AUTH_KEY, DB password) if exposure is suspected.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the 'Uppercase' commercial WordPress theme published by CodeSupply Co. (CPE: cpe:2.3:a:codesupplyco:uppercase:*). The weakness is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program, a.k.a. PHP Remote File Inclusion). In practice this means a PHP include()/require() call in the theme accepts attacker-controlled input - typically a request parameter referencing a template, page, or view - without sufficient allow-listing or path normalization, so traversal sequences or arbitrary file paths resolve to files outside the intended template directory. Because WordPress themes execute in the same PHP context as core, any LFI primitive can read files such as wp-config.php (database credentials, auth keys), /etc/passwd, or session/log files.
Know when Uppercase gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H because attacker must discover the vulnerable parameter; high confidentiality, limited integrity via log poisoning, no direct availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.
Executive ViewAI
The CodeSupply Co. Uppercase WordPress theme (versions before 1.2.2) contains a local file inclusion vulnerability enabling unauthenticated attackers to access and disclose sensitive files including source code and authentication credentials from affected web servers. Organizations deploying this theme face immediate risk of intellectual property exposure and credential compromise. No vendor patch is currently available, requiring urgent mitigation to secure affected systems.
Deactivate vulnerable theme and deploy alternative; implement Web Application Firewall rules blocking file traversal patterns; restrict file system permissions on WordPress configuration and log directories; deploy intrusion detection monitoring for LFI attack indicators; disable unnecessary PHP functions if feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB