Description
Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
Published: 2026-08-24
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Local File Inclusion that can allow read of arbitrary files
Action: Immediate Patch
AI Analysis

Impact

An unauthenticated local file inclusion vulnerability exists in the WordPress theme Måne in versions 1.7 and earlier. The theme fails to validate file path parameters before including them, granting an attacker the ability to specify arbitrary file paths that the theme will read. This can expose sensitive configuration data, or if a PHP file is served, may lead to code execution (this is inferred from typical LFI behavior). The weakness is identified as CWE‑98.

Affected Systems

The vulnerability affects the WordPress theme Måne from Elated‑Themes. Any site that has installed version 1.7 or earlier is impacted. Versions newer than 1.7 are not listed as vulnerable.

Risk and Exploitability

The flaw has a high CVSS score of 8.1, indicating a significant potential impact on confidentiality and integrity. No EPSS score is provided, and it is not listed in the CISA KEV catalog, so the current exploitation prevalence is unknown. The description indicates that the vulnerability can be triggered by an unauthenticated user via crafted HTTP requests that supply a malicious file path; the attacker must determine a valid file that can be read or executed by the WordPress code.

Generated by OpenCVE AI on August 24, 2026 at 14:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Måne theme to a patched version newer than 1.7.
  • If an upgrade is not possible, disable or remove the theme from the WordPress installation to eliminate the vulnerable code path.
  • Implement input validation and whitelist-based file inclusion for any remaining file inclusion points, and restrict the web server’s read permissions to prevent access to sensitive configuration files.

Generated by OpenCVE AI on August 24, 2026 at 14:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Elated-themes
Elated-themes måne
Wordpress
Wordpress wordpress
Vendors & Products Elated-themes
Elated-themes måne
Wordpress
Wordpress wordpress

Mon, 24 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
Title WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Elated-themes Måne
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-24T12:51:05.899Z

Reserved: 2026-07-27T14:00:48.793Z

Link: CVE-2026-66670

cve-icon Vulnrichment

Updated: 2026-08-24T12:47:22.696Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T12:16:53.730

Modified: 2026-08-24T16:40:53.647

Link: CVE-2026-66670

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T21:11:03Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')