What is the CVSS score of CVE-2026-65481?

CVE-2026-65481 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Vino Theme are affected by CVE-2026-65481?

The Vino WordPress theme (all versions through 1.9) contains a local file inclusion vulnerability that exposes sensitive configuration files to users with Contributor access, potentially revealing…

How to fix or mitigate CVE-2026-65481?

Within 24 hours, identify all WordPress sites running Vino theme version 1.9 or earlier and audit active Contributor accounts; immediately review and restrict Contributor role permissions in WordPress. Within 7 days, remove unnecessary Contributor accounts, enforce password resets for remaining contributors, and enable comprehensive audit logging of all Contributor activities. Within 30 days, monitor elated-themes for a security patch release and test thoroughly upon availability; if no patch is released within 60 days, prioritize migration to alternative WordPress themes with active security maintenance.

Vino Theme CVE-2026-65481

EUVD-2026-48092 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-23 Patchstack

GHSA-m9g5-jr43-6grw

PHP WordPress Information Disclosure LFI Vino Wordpress Theme Elated Themes

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Contributor login required so PR:L; Patchstack-noted extra conditions give AC:H; primary impact is file-read disclosure (C:H) with only incidental integrity risk (I:L) and no availability loss without confirmed RCE.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:34 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.5

DescriptionCVE.org

Contributor Local File Inclusion in Vino <= 1.9 versions.

Articles & Coverage 1

News 10 New PHP Vulnerabilities - 2 Critical, 8 High, 3 With POC Jul 24, 2026

AnalysisAI

Local File Inclusion in the Vino WordPress theme (elated-themes) affects all versions up to and including 1.9, letting an attacker holding a low-privileged Contributor account cause the theme to include and disclose arbitrary local files (e.g. wp-config.php) on the server. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported through Patchstack's WordPress vulnerability program. Because it requires a valid Contributor login and Patchstack rated attack complexity as high, real-world exploitation is gated behind account access rather than being fully open to the internet.

Technical ContextAI

The affected component is the Vino commercial WordPress theme (CPE cpe:2.3:a:elated-themes:vino), a PHP application running inside WordPress. The root cause is CWE-98, Improper Control of Filename for Include/Require Statement in a PHP Program (PHP File Inclusion): a PHP include/require path is built from attacker-influenced input without proper sanitization or allow-listing, so a user-supplied value is used to select the file that gets included. In a Local File Inclusion pattern the path resolves to files already on the host, exposing their contents; CWE-98's include/require primitive can, depending on the code path and server configuration (log poisoning, uploadable content, or PHP wrappers), escalate from disclosure toward code execution, which is why the source-assigned CVSS marks integrity and availability impact.

RemediationAI

No vendor-released patch version was identified at time of analysis in the provided data, so the exact fixed release cannot be cited without inventing a version - consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/vino/vulnerability/wordpress-vino-theme-1-9-local-file-inclusion-vulnerability) and the elated-themes changelog for the corrected build and upgrade to it as the primary fix once published. Until a patched version is confirmed, apply compensating controls: restrict or remove untrusted Contributor accounts and audit existing ones since exploitation requires that role (trade-off: limits guest-authoring workflows); deploy a WordPress-aware WAF such as Patchstack's virtual patch or an equivalent rule to block file-inclusion payloads and directory-traversal sequences targeting the theme's parameters (trade-off: rule tuning may cause false positives on legitimate content); and constrain PHP with open_basedir plus allow_url_include=Off and disabled PHP wrappers to cap what any inclusion can reach (trade-off: may break plugins that rely on broad filesystem access). If the theme is not actively required, deactivating it removes the exposure entirely.