Summary
CVE-2026-78566 is a Local File Inclusion (LFI) vulnerability in the Shuffle WordPress theme, developed by Edge-Themes, affecting all versions up to and including 1.8. The flaw allows unauthenticated, remote attackers to include and execute arbitrary files on the server, potentially resulting in execution of attacker-supplied PHP code. It carries a CVSS v3.1 base score of 8.1 (High).
Technical details
- Root cause: The theme fails to properly sanitize/control filenames passed into a PHP include or require statement (CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program).
- Trigger conditions: An attacker supplies a crafted filename/path parameter that is passed unsanitized into a file-inclusion function within the theme’s code.
- Attack vector: Network-based and does not require authentication or user interaction, though the CVSS vector indicates high attack complexity (AC:H).
- Impact: Successful exploitation can allow inclusion and execution of arbitrary local files, and — where an attacker can also place or control PHP content on the server (e.g., via file uploads or log poisoning) — execution of arbitrary PHP code. This can lead to full compromise of confidentiality, integrity, and availability of the affected WordPress site.
Affected software
- Edge-Themes Shuffle WordPress theme — all versions up to and including 1.8
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: At the time of publication, no fixed version of the Shuffle theme has been confirmed in the official CVE record. Site owners should check with Edge-Themes and the WordPress theme repository for an updated release that remediates this issue and apply it as soon as it becomes available.
- If no patch is available:
- Restrict or disable the Shuffle theme until a fix is released, or temporarily switch to an unaffected theme.
- Deploy a web application firewall (WAF) rule to block requests containing path traversal or file-inclusion patterns (e.g.,
../,php://, wrapper schemes) targeted at theme endpoints. - Disable PHP execution in upload directories and restrict write access to reduce the chance of attacker-controlled PHP content being included.
- Monitor web server and WordPress logs for anomalous file-path parameters or repeated inclusion attempts.
- Limit direct internet exposure of the WordPress admin and theme-related endpoints where feasible.

