What is the CVSS score of CVE-2026-39679?

CVE-2026-39679 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-39679?

ApusTheme Freeio WordPress theme versions 1.3.21 and earlier contain a local file inclusion vulnerability that allows authenticated users with low privileges to read sensitive files from the server.

PHP CVE-2026-39679

Q: How to fix or mitigate CVE-2026-39679?

Within 24 hours: Identify all WordPress installations using ApusTheme Freeio and document current versions via WordPress admin dashboard or security scanning tools. Within 7 days: Upgrade ApusTheme Freeio to version 1.3.22 or later (verify latest version on theme provider's repository). Within 30 days: Conduct file access audit to determine whether sensitive configuration files or user data were exposed; implement web application firewall rules to restrict file inclusion attempts if upgrade is delayed.

EUVD-2026-20362 HIGH

PHP Remote File Inclusion (CWE-98)

2026-04-08 Patchstack

PHP Information Disclosure LFI

7.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:27 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20362

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionNVD

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Freeio freeio allows PHP Local File Inclusion.This issue affects Freeio: from n/a through <= 1.3.21.

AnalysisAI

Local File Inclusion in ApusTheme Freeio WordPress theme (versions ≤1.3.21) allows authenticated attackers with low privileges to read arbitrary files on the server via PHP file inclusion flaws. Attack complexity is high (AC:H), requiring specific conditions beyond basic authentication. …

RemediationAI

Within 24 hours: Identify all WordPress installations using ApusTheme Freeio and document current versions via WordPress admin dashboard or security scanning tools. Within 7 days: Upgrade ApusTheme Freeio to version 1.3.22 or later (verify latest version on theme provider's repository). …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-39679 vulnerability details – vuln.today

Back

PHP CVE-2026-39679

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code