What is the CVSS score of CVE-2026-42382?

CVE-2026-42382 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Audrey WordPress Theme are affected by CVE-2026-42382?

The Audrey WordPress theme (versions ≤1.5) contains an unauthenticated remote vulnerability that permits attackers to access sensitive configuration files, database credentials, and API keys without…

How to fix or mitigate CVE-2026-42382?

Within 24 hours: Audit all WordPress installations to identify Audrey theme usage and versions; deploy WAF rules to block HTTP requests containing path traversal patterns (../) or queries for wp-config.php; document affected site inventory. Within 7 days: Contact elated-themes for patch status; begin testing migration to an alternative maintained WordPress theme in staging; restrict wp-admin access via IP allowlisting or network authentication. Within 30 days: Complete migration off Audrey theme or deactivate entirely; rotate all WordPress user passwords and database credentials; review access logs and WordPress logs for evidence of exploitation attempts.

Audrey WordPress Theme CVE-2026-42382

EUVD-2026-41340 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-02 Patchstack

GHSA-c2j6-447q-jv3m

LFI Information Disclosure PHP Audrey

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network LFI (PR:N/UI:N/AV:N) with high complexity (AC:H) from needed preconditions; CWE-98 remote-include path justifies C/I/A:H if RCE is achievable.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:12 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the Audrey WordPress theme (elated-themes) affects all versions up to and including 1.5, letting remote attackers coerce the PHP application into including arbitrary files. Because CWE-98 covers PHP file-inclusion flaws, a successful include can leak sensitive files (wp-config.php, credentials) and, where remote or attacker-controlled content is includable, escalate to code execution. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, though the network-reachable, unauthenticated nature (CVSS 8.1) makes it a meaningful patching priority for sites running this theme.

Technical ContextAI

Audrey is a commercial WordPress theme distributed by elated-themes, identified by CPE cpe:2.3:a:elated-themes:audrey. The flaw is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP), the root-cause class where user-influenced input reaches a PHP include()/require() call without proper validation or path restriction. In WordPress themes this typically arises from a template, AJAX handler, or query parameter that maps a request value directly onto a filesystem path, enabling directory traversal (../../wp-config.php) or, if allow_url_include/remote wrappers are permitted, inclusion of remote or attacker-staged content. The Patchstack tags (PHP, Information Disclosure, LFI) confirm the primary observed impact is disclosure of local files served through the PHP interpreter.

RemediationAI

No vendor-released patch version is identified at time of analysis from the provided data; consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/audrey/vulnerability/wordpress-audrey-theme-1-5-local-file-inclusion-vulnerability) and the elated-themes vendor channel for a fixed release above 1.5, and upgrade as soon as one is published. Until a patched version is available, restrict exploitation by placing a WAF or ruleset that blocks path-traversal sequences and PHP/data/http stream wrappers in request parameters reaching the theme, disable the vulnerable theme if it is not essential (trade-off: site appearance/functionality loss), and harden PHP by setting allow_url_include=Off and constraining open_basedir to the WordPress web root (trade-off: may break plugins relying on external includes). Additionally rotate any secrets in wp-config.php (database credentials, auth keys) in case files were already disclosed.