What is the CVSS score of CVE-2026-39590?

CVE-2026-39590 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Atomlab WordPress Theme are affected by CVE-2026-39590?

The Atomlab WordPress theme (versions 2.4.5 and earlier) contains an unauthenticated file inclusion vulnerability that enables attackers to access sensitive files and execute arbitrary PHP code on…

How to fix or mitigate CVE-2026-39590?

Within 24 hours: Scan all WordPress installations to identify use of Atomlab theme; if present, immediately disable the theme and activate an alternative. Within 7 days: Contact Atomlab or check vendor advisories to determine if a patched version is available; document remediation timeline. Within 30 days: Either migrate to an alternative theme (recommended approach) or upgrade Atomlab theme if vendor releases a patched version. Review web server and WAF logs for exploitation attempts.

Atomlab WordPress Theme CVE-2026-39590

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Atomlab

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects non-trivial preconditions to reach full RCE-grade C/I/A impact via include().

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:33 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.

AnalysisAI

Local file inclusion in the Atomlab WordPress theme versions 2.4.5 and earlier allows remote unauthenticated attackers to include arbitrary PHP files on the server, potentially leading to sensitive information disclosure and remote code execution. The flaw is tracked under CWE-98 (improper control of filename for include/require) and carries a CVSS 3.1 base score of 8.1 (high). No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Atomlab is a commercial WordPress theme distributed by ThemeMove (CPE cpe:2.3:a:thememove:atomlab). The root cause maps to CWE-98, Improper Control of Filename for Include/Require Statement in a PHP program, meaning a user-controlled value reaches a PHP include(), require(), include_once(), or require_once() call without adequate sanitization or allowlisting. In a WordPress theme context, this is typically a template-loading parameter, AJAX action, or shortcode handler that concatenates request input into a filesystem path, allowing attackers to traverse the filesystem (../) or supply alternate file paths to execute server-side PHP from arbitrary locations such as uploaded media, log files, or wrapper streams.

RemediationAI

No vendor-released patch identified at time of analysis; consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/atomlab/vulnerability/wordpress-atomlab-theme-2-4-5-local-file-inclusion-vulnerability for the latest fix status and upgrade to any version newer than 2.4.5 once ThemeMove publishes one. In the interim, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to block path-traversal sequences and PHP wrapper schemes (../, php://, file://, data://) in query parameters and POST bodies destined for the theme's PHP entry points, set PHP allow_url_include=Off and open_basedir to confine includes to the theme and WordPress directories, restrict filesystem write permissions for the web user so uploaded files cannot be turned into executable PHP, and consider temporarily switching to a different theme if the site is high-value while waiting for a vendor fix - each of these workarounds may break legitimate theme features that legitimately load template fragments dynamically.