What is the CVSS score of CVE-2026-39623?

CVE-2026-39623 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-39623?

CVE-2026-39623 affects kutethemes Biolife WordPress theme versions up to 3.2.3, allowing authenticated users with low privileges to execute arbitrary PHP code through local file inclusion,…

How to fix or mitigate CVE-2026-39623?

Within 24 hours: Identify all WordPress installations using kutethemes Biolife theme versions 3.2.3 and earlier; disable or remove the theme immediately. Within 7 days: Upgrade to kutethemes Biolife version 3.2.4 or later if available from the vendor, or select and deploy an alternative theme; audit user access logs for suspicious activity by authenticated users. Within 30 days: Conduct security review of all WordPress user accounts with editor or administrator privileges; implement Web Application Firewall (WAF) rules to restrict unusual file inclusion patterns.

PHP CVE-2026-39623

EUVD-2026-20266 HIGH

PHP Remote File Inclusion (CWE-98)

2026-04-08 Patchstack

GHSA-g5mv-4v3p-hp4g

Information Disclosure LFI PHP

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20266

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Biolife biolife allows PHP Local File Inclusion.This issue affects Biolife: from n/a through <= 3.2.3.

AnalysisAI

Local file inclusion vulnerability in kutethemes Biolife WordPress theme versions up to 3.2.3 enables authenticated attackers with low privileges to include and execute arbitrary PHP files from the server filesystem via improper filename control in include/require statements. Exploitation requires network access and high complexity conditions (CVSS:3.1 AV:N/AC:H/PR:L), potentially leading to information disclosure, code execution, and full system compromise. No public exploit identified at time of analysis. EPSS score indicates low observed exploitation activity (0.05%).

Technical ContextAI

CWE-98 vulnerability stems from insufficient sanitization of file paths passed to PHP include/require functions within the Biolife theme. Authenticated low-privilege users can manipulate path parameters to traverse directory structures and include local PHP files, enabling arbitrary code execution through server-side file inclusion. High attack complexity (AC:H) suggests exploitation requires specific server configurations or timing conditions.

RemediationAI

No vendor-released patch identified at time of analysis for versions beyond 3.2.3. Organizations using affected Biolife theme versions should immediately audit all include/require statements for user-controllable input and implement strict input validation with whitelisting of permitted file paths. Apply path canonicalization and prevent directory traversal sequences. Restrict file system permissions to minimize impact of successful exploitation. Monitor Patchstack advisory for updated patch information: https://patchstack.com/database/Wordpress/Theme/biolife/vulnerability/wordpress-biolife-theme-3-2-3-local-file-inclusion-vulnerability. If theme functionality is non-critical, consider deactivating until patched version becomes available. Implement web application firewall rules to detect and block path traversal attempts targeting theme components.