Atomlab WordPress Theme CVE-2026-39590

Exploitation requires that the target WordPress site has the Atomlab theme (versions <= 2.4.5) installed and active, and that the vulnerable theme PHP entry point is reachable over HTTP/HTTPS - no authentication or user interaction is needed per CVSS PR:N/UI:N. The AC:H rating indicates a non-trivial precondition such as knowledge of the specific parameter name, a particular request shape, or chaining with another resource (e.g., a writable upload directory or PHP wrapper availability) to achieve full impact, and PHP configuration hardening such as open_basedir or disabled URL wrappers can materially reduce achievable impact.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable, unauthenticated flaw with full CIA impact but high attack complexity, which usually reflects a non-trivial precondition such as needing a specific request shape or chaining a file upload. EPSS data was not provided in the input, and the CVE is not on CISA KEV, so there is no confirmation of in-the-wild exploitation. No public proof of concept is referenced beyond the Patchstack advisory, so this currently looks like a high-severity but not-yet-weaponized issue - defenders running Atomlab should treat it as a priority patch given the high impact and unauthenticated nature, even though widespread mass-exploitation evidence is absent.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable Atomlab theme endpoint with a manipulated path parameter that traverses the filesystem or points at a PHP wrapper, causing the server to include() an attacker-controlled or sensitive file. The attacker reads wp-config.php to harvest database credentials and secret keys, or chains the LFI with a writable upload location or log-poisoning to obtain remote PHP code execution under the web server account.