EUVD-2026-64810
GHSA-97pr-h63m-phh4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Local File Inclusion in the Måne WordPress theme (versions ≤ 1.7) exposes sites to unauthenticated file inclusion attacks exploitable over the network, classified under CWE-98 (Improper Control of Filename for PHP Include/Require). Attackers can force the theme's PHP code to include arbitrary server-side files, potentially exposing sensitive configuration data or — when chained with a writable server location — achieving remote code execution under the web server's process identity. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, though the vulnerability class is technically well-understood and widely targeted in WordPress ecosystems.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when M Ne gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
Executive ViewAI
WordPress sites using Måne theme version 1.7 and earlier are exposed to data breach and malicious code injection through an unauthenticated network vulnerability. With no vendor patch available, affected organizations face an urgent choice: migrate to a secure alternative theme or implement restrictive access controls. Organizations running this theme should prioritize immediate remediation to protect customer data and prevent business disruption.
Within 24 hours, audit all WordPress installations for Måne theme usage by version and immediately restrict public web access via firewall rules or take affected sites offline if business continuity allows. Within 7 days, contact the Måne theme developers for patch availability; if a patched version exists, prioritize its deployment; if no patch is forthcoming, evaluate and stage alternative well-maintained WordPress themes for migration. Within 30 days, complete the theme migration on all affected sites, reset all WordPress administrative credentials and database user passwords, conduct a forensic review of access logs and database activity for signs of prior exploitation, deploy Web Application Firewall (WAF) rules to block file inclusion payloads, and implement file integrity monitoring on wp-config.php and other sensitive configuration files.
No vendor-released patch identified at time of analysis. Interim controls: deploy WAF rules to block common PHP include exploitation patterns; restrict web server access via firewall to known administrative IP ranges only; disable PHP script execution in all upload directories via server configuration; enable query string logging and monitor for include/require parameter abuse; segment database user privileges to limit exposure if configuration theft occurs; maintain immutable backups for rapid recovery from compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB