What is the CVSS score of EUVD-2026-37481?

EUVD-2026-37481 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Mr. SEO are affected by EUVD-2026-37481?

The Mr. SEO WordPress theme versions 2.0 and earlier contains an unauthenticated file inclusion vulnerability (CVE-2026-39568, CVSS 8.1) enabling remote attackers to access sensitive files and…

How to fix or mitigate EUVD-2026-37481?

Within 24 hours: Identify all WordPress installations using Mr. SEO theme v2.0 or earlier via plugin inventory; immediately deactivate and disable the theme on all affected sites; review web server and PHP logs for suspicious file-inclusion patterns (/../, file://) from the past 30 days. Within 7 days: Complete migration to an alternative WordPress theme or hardened replacement; audit file-access logs for indicators of exploitation; restore from clean backup if unauthorized access detected. Within 30 days: Deploy Web Application Firewall (WAF) rules to block local file inclusion attempts; establish vendor notification subscription for Mr. SEO theme security advisories; conduct post-incident security assessment of compromised sites.

Mr. SEO EUVD-2026-37481

| CVE-2026-39568 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Mr Seo

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable LFI with no auth (PR:N) but non-trivial traversal payload (AC:H); high confidentiality from file disclosure, low integrity via possible log poisoning, no direct availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:36 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the Mr. SEO WordPress theme versions 2.0 and earlier allows remote attackers to include and execute arbitrary local PHP files on the server without authentication. The flaw, reported by Patchstack and tracked as CWE-98 (PHP Remote File Inclusion), enables information disclosure and potential remote code execution depending on what files are reachable on the host. No public exploit identified at time of analysis, though the theme's WordPress deployment context broadens the attack surface across affected sites.

Technical ContextAI

Mr. SEO is a commercial WordPress theme distributed by Elated Themes (CPE: cpe:2.3:a:elated-themes:mr._seo). The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), meaning user-controlled input flows into a PHP include() or require() statement without proper sanitization or allow-listing. In PHP-based WordPress themes, this typically arises when a GET/POST parameter is concatenated into a file path passed to include, allowing path traversal (../) to load arbitrary local files such as wp-config.php (containing DB credentials and auth keys) or, in some configurations, log files that can be poisoned for RCE.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory and EUVD record do not cite a fixed version, so administrators should treat Mr. SEO ≤2.0 as having no available upstream fix. Until a patched release is published by Elated Themes, deactivate and remove the Mr. SEO theme and switch to an alternate theme (side effect: site appearance changes and any theme-specific shortcodes break). If removal is not feasible, deploy a WordPress WAF rule (Wordfence, Patchstack vWAF, or equivalent) to block requests containing path-traversal sequences (../, %2e%2e%2f, php://, file://) targeting theme files under /wp-content/themes/mrseo/ (side effect: may break legitimate theme functionality that legitimately accepts file parameters). Additionally, harden PHP with open_basedir restrictions scoped to the WordPress document root and disable allow_url_include to limit the blast radius of any future include() abuse. Consult https://patchstack.com/database/wordpress/theme/mrseo/vulnerability/wordpress-mr-seo-theme-2-0-local-file-inclusion-vulnerability for the latest fix status.