What is the CVSS score of EUVD-2026-37475?

EUVD-2026-37475 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Getaway WordPress Theme are affected by EUVD-2026-37475?

The Getaway WordPress theme (versions before 1.8) contains a file inclusion vulnerability allowing unauthenticated external attackers to access sensitive files and potentially execute code.. A patch is available.

How to fix or mitigate EUVD-2026-37475?

24 hours: Identify all WordPress deployments using the Getaway theme and document current versions. 7 days: Update all instances to Getaway theme version 1.8 or later. 30 days: Review application and system logs for evidence of exploitation or suspicious file access attempts.

Getaway WordPress Theme EUVD-2026-37475

| CVE-2026-39547 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Getaway

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress theme endpoint, unauthenticated (PR:N), no user interaction, AC:H for required traversal/wrapper crafting; LFI yields file disclosure and likely RCE giving full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:39 vuln.today

Patch available

Jun 16, 2026 - 23:02 EUVD

DescriptionCVE.org

Unauthenticated Local File Inclusion in Getaway < 1.8 versions.

AnalysisAI

Local File Inclusion in the Getaway WordPress theme (versions before 1.8) by Select-Themes allows unauthenticated remote attackers to include arbitrary local PHP files via an unsanitized include/require parameter, leading to disclosure of sensitive files and potential code execution. The CWE-98 classification indicates improper control of filename used in PHP include/require, a pattern that frequently chains into RCE when log files, session files, or uploaded media can be referenced. No public exploit identified at time of analysis, and the issue is not in CISA KEV.

Technical ContextAI

The vulnerable component is the Getaway commercial WordPress theme distributed by Select-Themes (CPE cpe:2.3:a:select-themes:getaway). CWE-98 ('Improper Control of Filename for Include/Require Statement in PHP Program') is the classic PHP file-inclusion weakness: a user-controlled value is concatenated into an include(), require(), include_once(), or require_once() call without allowlisting or path normalization. In WordPress themes this typically appears in AJAX handlers, template loaders, or shortcode handlers that resolve a 'page', 'template', or 'file' parameter, and runs inside the WordPress PHP process with full filesystem permissions of the web user.

RemediationAI

Patch available per vendor advisory: upgrade the Getaway WordPress theme to version 1.8 or later as published by Select-Themes and tracked by Patchstack at https://patchstack.com/database/wordpress/theme/getaway/vulnerability/wordpress-getaway-theme-1-8-local-file-inclusion-vulnerability. If immediate upgrade is not possible, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to block requests containing path traversal sequences such as '../', null bytes, and 'php://' or 'file://' wrappers targeting Getaway theme endpoints, and restrict PHP execution and read access on wp-content/uploads to prevent log-poisoning chains - with the trade-off that overly broad rules can break legitimate AJAX template loading. Also confirm allow_url_include is Off in php.ini (it should be by default) to limit the inclusion to local files only, and audit access logs for prior exploitation since fix release.