What is the CVSS score of CVE-2026-39677?

CVE-2026-39677 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-39677?

CVE-2026-39677 affects Emphires WordPress theme versions 3.9 and earlier, enabling authenticated users with low privileges to read sensitive files from the server through a local file inclusion…

How to fix or mitigate CVE-2026-39677?

Within 24 hours: Identify all WordPress installations using Emphires theme and document current versions. Within 7 days: If theme version is ≤3.9, disable the theme, switch to an alternative, or restrict user role permissions that could trigger exploitation conditions. Within 30 days: Monitor vendor for patch release; contact theme vendor for security update timeline if unavailable. Apply patch immediately upon release to affected versions.

PHP CVE-2026-39677

EUVD-2026-20357 HIGH

PHP Remote File Inclusion (CWE-98)

2026-04-08 Patchstack

GHSA-w8h8-x9fm-43m9

PHP WordPress Information Disclosure LFI Emphires Wordpress Theme Creatives Planet

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:27 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20357

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Emphires emphires allows PHP Local File Inclusion.This issue affects Emphires: from n/a through <= 3.9.

AnalysisAI

Local File Inclusion in Emphires WordPress theme versions ≤3.9 allows authenticated attackers with low privileges to read arbitrary files from the server file system via improper PHP file inclusion controls. Attack complexity is rated high (AC:H), suggesting specific conditions must be met. EPSS exploitation probability is low (0.05%, 17th percentile) with no public exploit identified at time of analysis. Authenticated access requirement and high complexity reduce immediate risk despite CVSS 7.5 rating.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), a code injection weakness where PHP applications fail to validate file paths passed to include(), require(), or similar functions. The Emphires WordPress theme (developed by Creatives_Planet, CPE: cpe:2.3:a:creatives_planet:emphires) contains unsanitized user input reaching PHP file inclusion functions. While categorized as 'PHP Remote File Inclusion' in the vulnerability type, the actual exploitation pattern is Local File Inclusion (LFI) per Patchstack's classification and the CVE tags. This discrepancy suggests the vulnerable parameter accepts file paths that could theoretically reference remote resources if allow_url_include is enabled (rare in modern WordPress), but the practical exploit vector is reading local server files. LFI vulnerabilities typically exploit directory traversal (../) sequences or absolute paths to access sensitive files like /etc/passwd, wp-config.php, or application logs containing credentials.

RemediationAI

Upgrade Emphires WordPress theme to version 3.10 or later if available, as the vulnerability affects all versions through 3.9. Verify patch availability via the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/emphires/vulnerability/wordpress-emphires-theme-3-9-local-file-inclusion-vulnerability or check the theme developer's official channels. If patched versions are unavailable, implement interim mitigations: disable public user registration to limit PR:L attack surface, restrict authenticated user roles to trusted administrators only, implement Web Application Firewall rules blocking directory traversal patterns (../, absolute paths in theme parameters), and monitor server logs for suspicious file access attempts targeting configuration files. Consider replacing Emphires with actively maintained alternative themes if vendor support is discontinued.