What is the CVSS score of CVE-2026-39684?

CVE-2026-39684 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-39684?

UnTheme OrganicFood WordPress theme versions up to 3.6.4 contain a local file inclusion vulnerability that allows low-privileged authenticated users to read sensitive server files, including…

How to fix or mitigate CVE-2026-39684?

Within 24 hours: Inventory all WordPress installations using UnTheme OrganicFood theme and document current versions. Within 7 days: If theme version is 3.6.4 or earlier, immediately switch to an alternative theme or disable the affected theme; restrict low-privileged user roles from accessing WordPress admin functions as an interim control. Within 30 days: Implement a WordPress plugin management policy requiring theme updates and establish automated vulnerability scanning for WordPress plugins and themes.

PHP CVE-2026-39684

EUVD-2026-20372 HIGH

PHP Remote File Inclusion (CWE-98)

2026-04-08 Patchstack

GHSA-ggw9-84x2-h53g

PHP WordPress Information Disclosure LFI Organicfood Wordpress Theme

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20372

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnTheme OrganicFood organicfood allows PHP Local File Inclusion.This issue affects OrganicFood: from n/a through <= 3.6.4.

AnalysisAI

Local file inclusion in UnTheme OrganicFood WordPress theme versions up to 3.6.4 enables authenticated attackers with low privileges to read arbitrary files on the server and potentially achieve remote code execution. Exploitation requires network access and high attack complexity (CVSS AC:H), allowing disclosure of sensitive configuration data, credentials, and system files. Authenticated access (PR:L) is required. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.05%).

Technical ContextAI

CWE-98 PHP file inclusion flaw stems from improper validation of user-controlled input in file path construction for include/require statements. Despite description referencing remote file inclusion, CVSS vector and tags confirm local file inclusion (LFI). Affects cpe:2.3:a:untheme:organicfood WordPress theme. Attack complexity rated High suggests specific configuration or timing requirements for successful exploitation.

RemediationAI

No vendor-released patch identified at time of analysis for OrganicFood theme version >3.6.4. Immediate mitigation requires deactivating and removing the OrganicFood theme, replacing with an actively maintained alternative WordPress theme. For environments requiring continued use: implement web application firewall (WAF) rules to filter path traversal sequences (../, %2e%2e%2f) in HTTP requests, restrict PHP file access permissions to minimum necessary, and enable PHP open_basedir directive to limit file system access scope. Monitor Patchstack advisory for vendor patch announcements: https://patchstack.com/database/Wordpress/Theme/organicfood/vulnerability/wordpress-organicfood-theme-3-6-4-local-file-inclusion-vulnerability?_s_id=cve. Review NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-39684.