EUVD-2026-20357
GHSA-w8h8-x9fm-43m9
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Emphires emphires allows PHP Local File Inclusion.This issue affects Emphires: from n/a through <= 3.9.
AnalysisAI
Local File Inclusion in Emphires WordPress theme versions ≤3.9 allows authenticated attackers with low privileges to read arbitrary files from the server file system via improper PHP file inclusion controls. Attack complexity is rated high (AC:H), suggesting specific conditions must be met. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all WordPress installations using Emphires theme and document current versions. Within 7 days: If theme version is ≤3.9, disable the theme, switch to an alternative, or restrict user role permissions that could trigger exploitation conditions. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today