What is the CVSS score of EUVD-2026-37591?

EUVD-2026-37591 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Element Pack Pro are affected by EUVD-2026-37591?

Element Pack Pro WordPress plugin (versions 9.0.6 and earlier), a widely-deployed Elementor add-on by bdthemes, contains a local file inclusion vulnerability allowing authenticated contributors to…

How to fix or mitigate EUVD-2026-37591?

Within 24 hours: Identify all WordPress installations running Element Pack Pro; audit active contributor accounts and restrict the role to essential personnel only. Within 7 days: Review file system and web server access logs for unauthorized file read attempts; deploy Web Application Firewall rules targeting suspicious file path parameters in the plugin. Within 30 days: Monitor bdthemes security advisories for patch release and establish testing protocol for immediate deployment once available.

Element Pack Pro EUVD-2026-37591

| CVE-2026-40721 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Element Pack Pro

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Contributor auth gives PR:L; AC:H reflects non-trivial path/file constraints typical of LFI; confidentiality is high (arbitrary file read), but integrity/availability only low unless PHP execution is reliably reachable.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:19 vuln.today

DescriptionCVE.org

Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.

AnalysisAI

Local file inclusion in the Element Pack Pro WordPress plugin (versions 9.0.6 and earlier) allows authenticated contributors to read or include arbitrary server-side files via insufficient validation of a file path parameter, mapped to CWE-98 (improper control of filename for include/require). The flaw was reported through Patchstack and affects bdthemes' Element Pack Pro, a widely deployed Elementor add-on; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Element Pack Pro is a commercial Elementor extension by bdthemes that adds widgets and templates to WordPress sites, identified by CPE cpe:2.3:a:bdthemes:element_pack_pro. CWE-98 describes improper control of filename for PHP include/require statements, meaning user-controlled input flows into a PHP file inclusion call without adequate sanitization or allow-listing. In practice this typically manifests as a widget, template loader, or AJAX handler that accepts a path or template name and concatenates it into an include()/require() call, permitting traversal into arbitrary local PHP or text files reachable by the web server's user.

RemediationAI

Patch available per vendor advisory - update Element Pack Pro to a version newer than 9.0.6 as published by bdthemes, with the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack/vulnerability/wordpress-element-pack-pro-plugin-9-0-6-local-file-inclusion-vulnerability tracking the fixed release. As compensating controls until patching, tighten WordPress role policy so contributor and lower roles cannot be self-registered (set Settings > General > Membership off, or restrict via a registration plugin), audit existing contributor accounts and disable unused ones, and apply a virtual patch or WAF rule (Patchstack, Wordfence) that blocks traversal sequences and absolute paths against Element Pack Pro AJAX/REST endpoints; the trade-off is that aggressive path filtering can break legitimate template loading, so test in staging. If the plugin is non-essential, deactivate and remove it until the patched version is deployed.