CVE-2026-39552

WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability

Published Jun 2, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion.

This issue affects Blueprint: from n/a before 1.1.5.

Analysis

Technical impact

The vulnerability is an improper control of filename for include/require statements in PHP, allowing local file inclusion in the WordPress Blueprint theme. This flaw, classified as CWE-98, can enable an attacker to read arbitrary files on the server and, in some configurations, may lead to remote code execution if the attacker can supply or manipulate file paths used in includes.

Affected Systems

Affected systems are installations of the Code Supply Co. Blueprint theme for WordPress running any version prior to 1.1.5. Administrators should verify that the theme version in use is earlier than 1.1.5, as all earlier releases contain the LFI flaw.

Risk and Exploitability

The CVSS base score of 8.1 indicates a high severity impact. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Because the flaw permits inclusion of arbitrary local files, exploitation is likely to be feasible if web‑application or server misconfigurations allow user‑controlled parameters to influence include paths. The risk remains high until the theme is upgraded.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Code Supply Co.

Blueprint

unaffected

Version	Status	Constraints
`n/a`	affected	< 1.1.5

No data.

Vendor Product Versions

Code Supply Co.

Blueprint

Version	Status	Scheme	Platform
`[0,1.1.5)`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

Vendor Solution

Update the WordPress Blueprint Theme to the latest available version (at least 1.1.5).

OpenCVE Recommended Actions

Upgrade the Blueprint theme to version 1.1.5 or higher.
Restrict the theme's include paths by ensuring that no user input directly influences file inclusion and by applying input validation or sanitization.
Suspend or deactivate the Blueprint theme until the upgrade is applied.

Generated by OpenCVE AI on June 2, 2026 at 15:26 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.334% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://patchstack.com/database/wordpress/theme/blueprint/vulnerability/wordpress-blueprint-theme-1-1-5-local-file-inclusion-vulnerability?_s_id=cve

History

Jun 3, 2026 2:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Code Supply Co. Code Supply Co. blueprint Wordpress Wordpress wordpress
Vendors & Products		Code Supply Co. Code Supply Co. blueprint Wordpress Wordpress wordpress

Jun 2, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 2, 2026 2:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.
Title		WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability
Weaknesses		CWE-98
References		https://patchstack.com/database/wordpress/theme/blueprint/vulnerability/wordpress-blueprint-theme-1-1-5-local-file-inclusion-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`