What is the CVSS score of CVE-2026-39681?

CVE-2026-39681 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-39681?

ApusTheme Homeo WordPress theme versions 1.2.59 and earlier contain a local file inclusion vulnerability that allows low-privileged authenticated users to read arbitrary server files, potentially…

How to fix or mitigate CVE-2026-39681?

Within 24 hours: Audit current ApusTheme Homeo version across all WordPress installations and identify systems running version ≤1.2.59. Within 7 days: Restrict administrative and contributor access to only necessary users; implement file permission restrictions (644 on wp-config.php and other sensitive files) and disable PHP file execution in wp-content directories via .htaccess rules. Within 30 days: Contact vendor for patch availability timeline and evaluate theme replacement alternatives; deploy Web Application Firewall (WAF) rules to block suspicious file inclusion patterns in theme requests.

PHP CVE-2026-39681

EUVD-2026-20365 HIGH

PHP Remote File Inclusion (CWE-98)

2026-04-08 Patchstack

GHSA-c4fh-xf35-vp6g

PHP Information Disclosure LFI

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:27 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20365

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Homeo homeo allows PHP Local File Inclusion.This issue affects Homeo: from n/a through <= 1.2.59.

AnalysisAI

Local File Inclusion in ApusTheme Homeo WordPress theme versions ≤1.2.59 allows authenticated attackers with low privileges to read arbitrary files on the server via improper file inclusion controls. The vulnerability stems from insufficient validation of file paths in PHP include/require statements, enabling access to sensitive configuration files, credentials, or other restricted content. EPSS score of 0.05% (17th percentile) indicates low predicted exploitation probability, and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

This vulnerability affects ApusTheme Homeo (cpe:2.3:a:apustheme:homeo), a WordPress theme, through version 1.2.59. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Local File Inclusion (LFI). Despite the CVE description mentioning 'PHP Remote File Inclusion' in the vulnerability name, the tags and EUVD classification confirm this is an LFI issue. LFI vulnerabilities occur when user-controllable input is passed unsanitized to PHP file inclusion functions like include(), require(), include_once(), or require_once(). Attackers can manipulate file path parameters to traverse directory structures (../) and include arbitrary local files. In WordPress themes, this typically occurs in template handling, AJAX endpoints, or dynamic content loading mechanisms where file paths are constructed from user input without proper sanitization or whitelist validation.

RemediationAI

Upgrade ApusTheme Homeo theme to version 1.2.60 or later, which addresses the file inclusion vulnerability through improved input validation and sanitization of file path parameters. WordPress administrators should access the theme update through the WordPress dashboard (Appearance > Themes > Update) or download the latest version directly from ApusTheme's official distribution channel. After upgrading, verify that all theme functionality operates correctly, particularly custom template features and dynamic content loading. As a temporary workaround if immediate patching is not possible, restrict WordPress user registration to trusted administrators only, implement principle of least privilege by reviewing user role assignments, and monitor web server access logs for suspicious file path traversal attempts (patterns containing '../' or absolute paths in URL parameters). Consider implementing web application firewall (WAF) rules to block common LFI attack patterns targeting WordPress themes. Detailed vulnerability information and remediation guidance is available from Patchstack at https://patchstack.com/database/Wordpress/Theme/homeo/vulnerability/wordpress-homeo-theme-1-2-59-local-file-inclusion-vulnerability and NIST NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-39681.