What is the CVSS score of EUVD-2026-20362?

EUVD-2026-20362 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2026-20362?

ApusTheme Freeio WordPress theme versions 1.3.21 and earlier contain a local file inclusion vulnerability that allows authenticated users with low privileges to read sensitive files from the server.

How to fix or mitigate EUVD-2026-20362?

Within 24 hours: Identify all WordPress installations using ApusTheme Freeio and document current versions via WordPress admin dashboard or security scanning tools. Within 7 days: Upgrade ApusTheme Freeio to version 1.3.22 or later (verify latest version on theme provider's repository). Within 30 days: Conduct file access audit to determine whether sensitive configuration files or user data were exposed; implement web application firewall rules to restrict file inclusion attempts if upgrade is delayed.

PHP EUVD-2026-20362

| CVE-2026-39679 HIGH

PHP Remote File Inclusion (CWE-98)

2026-04-08 Patchstack

PHP Information Disclosure LFI

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:27 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20362

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Freeio freeio allows PHP Local File Inclusion.This issue affects Freeio: from n/a through <= 1.3.21.

AnalysisAI

Local File Inclusion in ApusTheme Freeio WordPress theme (versions ≤1.3.21) allows authenticated attackers with low privileges to read arbitrary files on the server via PHP file inclusion flaws. Attack complexity is high (AC:H), requiring specific conditions beyond basic authentication. EPSS probability is low (0.05%, 17th percentile) with no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.

Technical ContextAI

This vulnerability stems from improper control of filename parameters in PHP include/require statements (CWE-98), commonly called Local File Inclusion (LFI). Despite the CVE description mentioning 'PHP Remote File Inclusion,' the tags and technical classification confirm this is an LFI vulnerability. The Freeio WordPress theme by ApusTheme fails to properly sanitize user-supplied input used in file path construction, allowing authenticated users to traverse directory structures and include local files. In PHP applications, include/require statements dynamically load files at runtime - if user input influences the file path without validation, attackers can reference files outside intended directories using path traversal sequences (../) or absolute paths. The affected component is the Freeio theme (CPE: cpe:2.3:a:apustheme:freeio), a WordPress commercial theme, affecting all versions from initial release through 1.3.21. WordPress themes execute with web server privileges, so successful exploitation provides read access to any file the web server process can access, including wp-config.php (containing database credentials), /etc/passwd, application logs, and other sensitive server files.

RemediationAI

Update ApusTheme Freeio theme to version 1.3.22 or later if available. Check the official ApusTheme website or WordPress theme dashboard for updates addressing CVE-2026-39679. If an updated version is not yet released or available through your purchase channel, implement temporary mitigations: restrict authenticated user access to trusted users only, disable theme-specific functionality that accepts file path parameters if possible, implement web application firewall (WAF) rules to detect path traversal patterns in requests to theme endpoints, and monitor server logs for suspicious file access patterns including attempts to read /etc/passwd, wp-config.php, or unusual file paths. Review user roles and remove unnecessary low-privilege accounts that could be leveraged for exploitation. Consult Patchstack advisory for specific technical details at https://patchstack.com/database/Wordpress/Theme/freeio/vulnerability/wordpress-freeio-theme-1-3-21-local-file-inclusion-vulnerability and contact ApusTheme support for patch availability timeline. Consider migrating to an alternative WordPress theme if vendor support is unavailable or unresponsive.