CVE-2026-39553

WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability

View on CVE.org
Published Jun 2, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion.

This issue affects WaveRide: from n/a through 1.4.

Analysis

AI-generated

Technical impact

The Select-Themes WaveRide WordPress theme contains an improper control of filename in a PHP include/require statement (CWE‑98). This flaw can allow an attacker to trigger local file inclusion, potentially read sensitive files, and, depending on server configuration, could enable execution of arbitrary code. Execution of arbitrary code is an inference based on the LFI capability.

Affected Systems

Select-Themes:WaveRide WordPress theme releases up to version 1.4 are affected. WordPress sites that use this theme are vulnerable; versions newer than 1.4 are presumed not affected.

Risk and Exploitability

The vulnerability has a CVSS score of 8.1, indicating high severity. An attacker can exploit it by sending a crafted request that causes the theme to include a local file; the exact attack vector is not fully detailed in the advisory, so the likely vector appears to be through web input that passes to the include statement. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog; remote code execution is an inference based on the local file inclusion capability and could be possible depending on server configuration.

Remediation

Vendor Solution

Update the WordPress WaveRide Theme to the latest available version (at least 1.5).

OpenCVE Recommended Actions

  • Upgrade the WaveRide theme to version 1.5 or later, which removes the insecure filename handling.
  • Ensure that all include or require calls in the theme validate the target path against a whitelist, preventing arbitrary file resolution.
  • Restrict theme edit permissions, disable the WordPress Edit Files feature, and limit access to users who need it to reduce the attack surface.

Generated by OpenCVE AI on June 2, 2026 at 16:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Select-themes
Select-themes waveride
Wordpress
Wordpress wordpress
Vendors & Products Select-themes
Select-themes waveride
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.
Title WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Jun 2, 2026, 2:45 PM
Reserved
Apr 7, 2026, 10:48 AM

View source JSON

Updated
Jun 2, 2026, 2:45 PM

JSON

Status
Deferred
Published
Jun 2, 2026, 2:16 PM
Modified
Jul 22, 2026, 7:10 PM

View source JSON

No data.

Updated
Jun 2, 2026, 8:51 PM

JSON