Summary
CVE-2026-66670 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting the Måne WordPress theme (developed by Elated-Themes), versions 1.7 and earlier. The flaw allows a remote, unauthenticated attacker to force the theme to include arbitrary local files via improper control of a filename parameter passed to a PHP include/require statement. The issue carries a CVSS v3.1 base score of 8.1 (High).
Technical details
- Root cause: The theme fails to properly sanitize/validate a user-controllable filename parameter before passing it to a PHP file-inclusion function (
include/requireor equivalent), classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). - Trigger conditions: An attacker sends a crafted HTTP request to the WordPress site with a manipulated filename/path parameter; no authentication or user interaction is required.
- Attack vector: Network-based (AV:N), with high attack complexity (AC:H), no privileges required (PR:N), and no user interaction (UI:N).
- Impact: Successful exploitation can result in disclosure of arbitrary local files, and depending on server configuration, may enable inclusion of attacker-controlled files leading to remote code execution, full compromise of confidentiality, integrity, and availability of the affected site.
Affected software
- Elated-Themes Måne WordPress theme, versions 1.7 and earlier
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Upgrade the Måne theme to a version newer than 1.7 as soon as the vendor makes a fixed release available. At the time of writing, no vendor-confirmed patched version has been publicly identified.
- If no patch is available:
- Restrict or disable public access to the affected theme’s file-inclusion functionality via a web application firewall (WAF) rule blocking directory traversal / path manipulation patterns in requests.
- Review server PHP configuration to disable
allow_url_includeand hardenopen_basedirrestrictions to limit the impact of any inclusion attempt. - Monitor web server logs for anomalous requests containing path traversal sequences (e.g.,
../) or unexpected file parameters targeting the theme. - Consider temporarily deactivating the Måne theme on internet-facing WordPress sites until a fix is confirmed and applied.

