CVE-2026-39547: WordPress Getaway theme < 1.8 - Local File Inclusion vulnerability

Synopsis

A local file inclusion vulnerability affects the WordPress Getaway theme by Select-Themes in versions before 1.8. The flaw is reachable over the network without any authentication, though exploitation requires meeting certain environmental conditions. A successful attacker can read, and potentially execute, arbitrary files on the server, leading to full confidentiality loss, data tampering, and service disruption. A patched-image rebuild at version 1.8 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable theme endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is exploitable by any unauthenticated network request.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends requests directly to the server without any victim involvement.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must account on specific environmental conditions, such as particular server configurations or file-path constraints, before the inclusion can be triggered reliably.

Blast Radius

• A successful attacker reads arbitrary files on the web server, including WordPress configuration files that contain database credentials and secret keys.
• The attacker can tamper with or overwrite files accessible to the web server process, modifying theme files, plugins, or application data.
• If the server is configured to execute included files (for example through PHP wrappers), the attacker gains remote code execution on the host.
• In a worst-case scenario, full compromise of the web server process crashes or destabilizes the WordPress service, causing an outage.