CVE-2026-39558: WordPress Malmö theme <= 2.2 - Local File Inclusion vulnerability

Synopsis

A local file inclusion vulnerability affects the Malmö WordPress theme at version 2.2 and below. The flaw is reachable over the network without any authentication, allowing an attacker to force the web server to load arbitrary files from the local filesystem. Successful exploitation gives an attacker the ability to read sensitive files, execute server-side code through log poisoning or similar techniques, and fully compromise the host. No fix has been published yet; HarborGuard tracks the advisory and will surface a patched rebuild the moment upstream ships a remediated version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to send HTTP requests to the web server hosting the Malmö theme.

• AuthenticationNot required

  No account or session credential of any kind is needed to trigger the file inclusion.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning reliable triggering depends on specific environmental conditions such as particular server configurations, file layout assumptions, or timing factors that the attacker cannot fully control.

Blast Radius

• Reads arbitrary files from the server filesystem, including WordPress configuration files that contain database credentials and secret keys.
• Reads sensitive operating-system files such as /etc/passwd, application logs, and private key material accessible to the web server process.
• Enables code execution on the server through log-poisoning or other file-inclusion chaining techniques, giving the attacker full control of the WordPress host.
• Modifies or destroys application data if the attacker leverages gained credentials or code execution to interact with the underlying database.