What is the CVSS score of CVE-2026-40731?

CVE-2026-40731 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of ChapterOne WordPress Theme are affected by CVE-2026-40731?

The ChapterOne WordPress theme (versions 1.7 and earlier) contains an unauthenticated vulnerability enabling attackers to read arbitrary local files, including wp-config.php with database credentials…

How to fix or mitigate CVE-2026-40731?

Within 24 hours: Audit all WordPress installations for ChapterOne theme v1.7 or earlier; restrict web server file permissions to deny wp-config.php access. Within 7 days: Remove the theme from production or deploy WAF rules blocking path traversal patterns (../) and wp-config.php requests; review database access logs for unauthorized activity. Within 30 days: Migrate affected sites to an alternative maintained WordPress theme; rotate database credentials if compromise is suspected; conduct forensic review of access logs.

ChapterOne WordPress Theme CVE-2026-40731

EUVD-2026-37596 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Chapterone

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable PHP LFI without auth (AV:N/PR:N/UI:N); AC:H reflects unknown specific parameter/path; primary impact is file disclosure (C:H) with limited integrity and no inherent availability impact absent confirmed RCE chain.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:18 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.

AnalysisAI

Unauthenticated local file inclusion in the Mikado-Themes ChapterOne WordPress theme (versions 1.7 and earlier) allows remote attackers to coerce the PHP application into including arbitrary local files via crafted requests. Successful exploitation can disclose sensitive files such as wp-config.php and, depending on server configuration, lead to PHP code execution by including attacker-influenced content. No public exploit identified at time of analysis, but the vulnerability is publicly cataloged by Patchstack.

Technical ContextAI

ChapterOne is a commercial WordPress theme published by Mikado-Themes (CPE cpe:2.3:a:mikado-themes:chapterone). The root cause is CWE-98, improper control of filename for PHP include/require statements, meaning a user-controllable parameter is passed to a PHP file inclusion sink without proper validation, normalization, or allowlisting. In WordPress themes this pattern typically appears in an AJAX action, template loader, or shortcode handler that accepts a path or template name from a request parameter and concatenates it into an include()/require() call, allowing path traversal sequences or absolute paths to reach files outside the intended directory.

RemediationAI

No vendor-released patched version is identified in the available data for ChapterOne, so the primary action is to monitor Mikado-Themes and the Patchstack advisory at https://patchstack.com/database/wordpress/theme/chapterone/vulnerability/wordpress-chapterone-theme-1-7-local-file-inclusion-vulnerability for an updated release above 1.7 and apply it immediately when published. In the interim, deploy a WAF rule (Patchstack, Wordfence, or ModSecurity) to block requests containing path traversal sequences (../, encoded variants, php://, file:// wrappers) targeting ChapterOne theme endpoints under /wp-content/themes/chapterone/, with the trade-off of potentially blocking legitimate template parameters; restrict PHP open_basedir to the WordPress root to prevent reading arbitrary system files such as /etc/passwd or /proc, accepting that some plugins relying on system paths may break; and as a last resort switch the site to a different theme until a fix is shipped, recognizing the visual/functional disruption that entails.