What is the CVSS score of CVE-2026-66670?

CVE-2026-66670 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2026-66670?

WordPress sites using Måne theme version 1.7 and earlier are exposed to data breach and malicious code injection through an unauthenticated network vulnerability.

How to fix or mitigate CVE-2026-66670?

Within 24 hours, audit all WordPress installations for Måne theme usage by version and immediately restrict public web access via firewall rules or take affected sites offline if business continuity allows. Within 7 days, contact the Måne theme developers for patch availability; if a patched version exists, prioritize its deployment; if no patch is forthcoming, evaluate and stage alternative well-maintained WordPress themes for migration. Within 30 days, complete the theme migration on all affected sites, reset all WordPress administrative credentials and database user passwords, conduct a forensic review of access logs and database activity for signs of prior exploitation, deploy Web Application Firewall (WAF) rules to block file inclusion payloads, and implement file integrity monitoring on wp-config.php and other sensitive configuration files.

PHP CVE-2026-66670

EUVD-2026-64810 HIGH

PHP Remote File Inclusion (CWE-98)

2026-08-24 Patchstack

GHSA-97pr-h63m-phh4

PHP Information Disclosure LFI M Ne WordPress Wordpress Theme

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 24, 2026 - 12:24 vuln.today

CVE Published

Aug 24, 2026 - 11:54 cve.org

HIGH 8.1

DescriptionCVE.org

Unauthenticated Local File Inclusion in Måne <= 1.7 versions.

AnalysisAI

Local File Inclusion in the Måne WordPress theme (versions ≤ 1.7) exposes sites to unauthenticated file inclusion attacks exploitable over the network, classified under CWE-98 (Improper Control of Filename for PHP Include/Require). Attackers can force the theme's PHP code to include arbitrary server-side files, potentially exposing sensitive configuration data or — when chained with a writable server location — achieving remote code execution under the web server's process identity. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, audit all WordPress installations for Måne theme usage by version and immediately restrict public web access via firewall rules or take affected sites offline if business continuity allows. …

Threat intelligence, references, and detailed analysis are available after sign-in.