Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Verdure verdure allows PHP Local File Inclusion.This issue affects Verdure: from n/a through <= 1.6.
Published: 2026-03-05
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Local File Inclusion (potential RCE)
Action: Patch Immediately
AI Analysis

Impact

The vulnerability is an improper control of filename for include/require statements in the Mikado‑Themes Verdure WordPress theme, allowing a Local File Inclusion. An attacker can supply a crafted request to the theme to include arbitrary local files, potentially reading sensitive information or executing code if the included file is PHP. The weakness is classified as CWE‑98 and can be leveraged to compromise site confidentiality, integrity, and possibly availability.

Affected Systems

Mikado‑Themes Verdure theme for WordPress, versions 1.6 and earlier.

Risk and Exploitability

The CVSS score is 8.1, indicating high severity. The EPSS score is less than 1 %, suggesting that exploitation likelihood is currently low. The vulnerability is not listed in the CISA KEV catalog. It is inferred that the attack vector requires access to the theme’s PHP files via a web request, making online attackers the most likely exploitants.

Generated by OpenCVE AI on April 16, 2026 at 05:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Verdure theme to the latest available version, or replace it with a secure alternative.
  • If a patch is not yet available, remove or disable the Verdure theme to prevent the LFI vector from being exposed.
  • Enforce strict file permissions on the WordPress installation directory and disable PHP execution in directories that should only contain static assets.
  • Verify that all input parameters used in include/require statements are properly validated and sanitized to eliminate CWE‑98 exploitation.

Generated by OpenCVE AI on April 16, 2026 at 05:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 06 Mar 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Mikado-themes
Mikado-themes verdure
Wordpress
Wordpress wordpress
Vendors & Products Mikado-themes
Mikado-themes verdure
Wordpress
Wordpress wordpress

Thu, 05 Mar 2026 06:15:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Verdure verdure allows PHP Local File Inclusion.This issue affects Verdure: from n/a through <= 1.6.
Title WordPress Verdure theme <= 1.6 - Local File Inclusion vulnerability
Weaknesses CWE-98
References

Subscriptions

Mikado-themes Verdure
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-01T14:13:48.939Z

Reserved: 2026-01-07T12:22:06.512Z

Link: CVE-2026-22429

cve-icon Vulnrichment

Updated: 2026-03-09T16:31:15.058Z

cve-icon NVD

Status : Deferred

Published: 2026-03-05T06:16:16.983

Modified: 2026-04-22T21:26:58.303

Link: CVE-2026-22429

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T05:45:26Z

Weaknesses