What is the CVSS score of CVE-2026-39582?

CVE-2026-39582 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Hitek WordPress Theme are affected by CVE-2026-39582?

The Xtemos Hitek WordPress theme versions prior to 1.8.3 contain an unauthenticated local file inclusion vulnerability (CVSS 8.1) that allows attackers to access sensitive configuration files and…. A patch is available.

How to fix or mitigate CVE-2026-39582?

Within 24 hours: Identify all WordPress installations using the Hitek theme and temporarily deactivate or remove the theme; enable emergency monitoring for exploitation attempts via file access logs. Within 7 days: Deploy WAF rules to block file inclusion attack patterns targeting the affected theme versions; review server logs for any suspicious include/require activity; begin evaluation of alternative WordPress themes. Within 30 days: Monitor Xtemos security advisories for patch release; establish deployment plan for patched version 1.8.3 or later once available; document lessons learned on theme vetting processes.

Hitek WordPress Theme CVE-2026-39582

EUVD-2026-37677 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP WordPress Information Disclosure LFI Hitek Wordpress Theme Xtemos

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable theme endpoint with no auth or UI (AV:N/PR:N/UI:N); AC:H reflects undisclosed exploitation prerequisites; LFI primarily yields file disclosure (C:H) with limited integrity/availability impact absent confirmed RCE chain.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 17, 2026 - 13:01 EUVD

Analysis Generated

Jun 17, 2026 - 12:22 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.

AnalysisAI

Unauthenticated local file inclusion in the Xtemos Hitek WordPress theme versions prior to 1.8.3 allows remote attackers to include and execute arbitrary local files on the server via crafted requests, mapped to CWE-98 (Improper Control of Filename for Include/Require Statement in PHP). With a CVSS 3.1 score of 8.1 and high attack complexity but no authentication required, successful exploitation can lead to source code disclosure, sensitive configuration exposure, and potential remote code execution. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the Hitek commercial WordPress theme developed by Xtemos (CPE: cpe:2.3:a:xtemos:hitek), a PHP-based theme commonly used for music and entertainment websites. CWE-98 describes PHP Remote/Local File Inclusion (RFI/LFI) where user-controllable input is passed directly into PHP include/require statements without proper validation or sanitization. In WordPress themes, this typically manifests through AJAX handlers, template loaders, or URL parameters that accept file paths and are processed via include(), require(), or file_get_contents() functions, enabling traversal to files outside the intended directory such as wp-config.php, /etc/passwd, or session files.

RemediationAI

Patch available per vendor advisory - upgrade the Hitek theme to version 1.8.3 or later via the WordPress admin theme updater or by obtaining the latest release from the Xtemos/Themeforest distribution channel, as documented at https://patchstack.com/database/wordpress/theme/xts-hitek/vulnerability/wordpress-hitek-theme-1-8-3-local-file-inclusion-vulnerability. If immediate patching is not possible, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to block requests containing path traversal sequences (../, %2e%2e%2f) and PHP wrapper schemes (php://, phar://, data://) targeting theme endpoints; note this may produce false positives for legitimate file-handling features. As an additional compensating control, restrict PHP's allow_url_include and open_basedir directives to confine include paths to the WordPress installation root, with the trade-off that some plugins or themes relying on broader filesystem access may break.