Mane Theme CVE-2026-78478

Unauthenticated file disclosure via LFI requires only network access to a WordPress installation running Mane theme version 1.7 or earlier - no credentials or special configuration are needed, consistent with CVSS PR:N. Escalation to remote code execution requires the additional precondition that an attacker-controlled file containing PHP code is present on the server's filesystem at a known or guessable path; this is most commonly achieved by uploading a PHP payload disguised as an image through WordPress's native media library or a theme-provided upload form. Exploitation is constrained by the following factors: (1) the AC:H rating indicates that achieving RCE is not straightforward and requires the file-presence precondition to be met; (2) sites that restrict the media upload endpoint to authenticated users or disable it entirely close the primary RCE pathway; (3) PHP open_basedir restrictions, if enforced, limit which filesystem paths can be included; and (4) server-side execution of PHP must not be blocked for the directories containing uploaded files. Basic file disclosure (e.g., reading wp-config.php) is a lower-bar impact achievable without file upload, limited mainly by the attacker's ability to guess or infer valid server paths.

The CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity but conditionally exploitable vulnerability: unauthenticated network access with full CIA impact is offset by the AC:H designation, which captures the requirement for a specific precondition - almost certainly the presence of an attacker-controlled file on the server filesystem. This CVE does not appear in the CISA KEV catalog and no EPSS data was included in the available intelligence, indicating no confirmed active exploitation at time of analysis; however, absence from KEV is not confirmation of safety. The LFI attack class against WordPress themes is extensively documented and tooled, meaning exploitation complexity in practice may be lower than AC:H implies for sites that accept unauthenticated file uploads. Even a mid-sized municipal IT team in zabrze managing a portfolio of WordPress sites should treat this as an urgent remediation, because the combination of unauthenticated access and potential full server compromise via a well-known attack chain is precisely the profile that opportunistic attackers exploit systematically. No POC code has been publicly identified, which modestly reduces near-term mass-exploitation risk but does not justify deferral.

An unauthenticated attacker, informed by the public Wordfence advisory, identifies a WordPress site running the Mane theme and locates the LFI-vulnerable request parameter. The attacker first uploads a PHP webshell embedded in a file with an image extension through the site's WordPress media upload endpoint or any theme-provided upload form, then sends a crafted HTTP request that supplies the uploaded file's server-side path to the vulnerable include parameter. The server executes the embedded PHP code with the privileges of the web server process, granting the attacker an interactive shell. No public exploit code has been identified at time of analysis.