CVE-2026-39553: WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability

Synopsis

Local File Inclusion (LFI) is a class of vulnerability where an attacker manipulates a file path parameter to force the application to load and execute a file already present on the server. The WaveRide WordPress theme by Select-Themes, versions 1.4 and earlier, contains such a flaw reachable over the network with no authentication required, though exploitation requires meeting certain environmental conditions reflected in the high attack complexity rating. Successful exploitation gives an attacker full read and write access to the underlying host and can crash the service entirely. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable theme endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP or HTTPS to send a crafted request.

• AuthenticationNot required

  No account or session token is needed; the file inclusion parameter can be triggered by an unauthenticated request.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must account for specific environmental conditions, such as predictable file paths, writable directories, or particular server configurations, before the inclusion can be weaponized reliably.

Blast Radius

• An attacker can read arbitrary files on the server, including WordPress wp-config.php credentials, private keys, and other secrets stored on the filesystem.
• An attacker can achieve code execution by including a PHP file already present on the host, allowing full control over the WordPress process and its runtime environment.
• Database credentials exposed through file read can be used to modify or delete persisted WordPress content, user records, and configuration rows.
• The process running WordPress can be crashed or rendered unresponsive through inclusion of a malformed or resource-exhausting file, taking the site offline.