What is the CVSS score of CVE-2026-52707?

CVE-2026-52707 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Kastell WordPress Theme are affected by CVE-2026-52707?

The Mikado-Themes Kastell WordPress theme (versions ≤2.0) contains a remote file-inclusion vulnerability (CVSS 8.1) that enables unauthenticated attackers to read sensitive configuration files…

How to fix or mitigate CVE-2026-52707?

Within 24 hours: Identify and catalog all WordPress installations using Kastell theme versions ≤2.0 and assess active deployment status. Within 7 days: Deactivate the vulnerable theme and migrate to an alternative WordPress theme; do not enable versions ≤2.0 pending vendor patch release. Within 30 days: Audit WordPress access logs for exploitation indicators; reset all database credentials, WordPress API keys, and authentication salts as a precautionary measure.

Kastell WordPress Theme CVE-2026-52707

HIGH

Path Traversal: '.../...//' (CWE-35)

2026-06-17 Patchstack

WordPress Information Disclosure Kastell Wordpress Theme Mikado Themes

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable, unauthenticated, no UI; AC:H reflects the specific traversal-encoding needed for CWE-35; C:H for full file disclosure (wp-config), I/A lowered to L absent confirmed code-execution primitive.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:28 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the Mikado-Themes Kastell WordPress theme (versions ≤ 2.0) allows remote attackers to traverse directories and read or include arbitrary server-side files, potentially leading to disclosure of sensitive configuration data such as wp-config.php and, depending on PHP configuration, code execution. The flaw is reported via Patchstack with CVSS 8.1 (high) and no public exploit identified at time of analysis. The CWE-35 classification (Path Traversal: '.../...//') points to relative-path manipulation as the root cause.

Technical ContextAI

Kastell is a commercial WordPress theme distributed by Mikado-Themes, identified by CPE cpe:2.3:a:mikado-themes:kastell:*. The vulnerability falls under CWE-35 (Path Traversal: '.../...//'), a variant where attackers use crafted sequences of dots and slashes that survive naive sanitization (e.g., stripping single '../') to escape the intended directory. In WordPress themes, such flaws typically appear in AJAX handlers or template-loading endpoints that take a filename or path parameter and pass it to PHP file-inclusion functions (include, require, file_get_contents) without proper canonicalisation or allow-listing. The result is that an unauthenticated HTTP request can cause the theme to include arbitrary local files served by the PHP process.

RemediationAI

Upgrade the Kastell theme to a version newer than 2.0 once the vendor (Mikado-Themes) publishes a fixed release; the supplied data does not list an exact patched version, so site owners should monitor Patchstack (https://patchstack.com/database/wordpress/theme/kastell/vulnerability/wordpress-kastell-theme-2-0-local-file-inclusion-vulnerability) and the Mikado-Themes changelog for the corrected build. Until a vendor patch is installed, enable Patchstack's or Wordfence's virtual patching, or place a WAF rule blocking requests containing traversal sequences (../, ..%2f, ....//, %252e%252e/) against theme AJAX endpoints (typically /wp-admin/admin-ajax.php with theme-specific actions and /wp-content/themes/kastell/*.php) - note this can break legitimate AJAX calls and should be tested. As a stronger interim control, deactivate the Kastell theme and switch to a default theme, accepting the loss of site presentation, or restrict /wp-content/themes/kastell/ from direct PHP execution via the webserver where the theme architecture allows. Hardening php.ini with open_basedir limits the files an LFI can reach but does not block the vulnerability itself.