CVE-2026-39559: WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability

Synopsis

A local file inclusion vulnerability exists in the WordPress Uppercase theme prior to version 1.2.2. Reachable over the network with no authentication required, an attacker can manipulate file path inputs to force the server to load arbitrary files from the host filesystem. Successful exploitation gives the attacker full read access to sensitive server files, the ability to tamper with data, and can bring down the affected service entirely. A patched-image rebuild at version 1.2.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP or HTTPS to exploit this flaw.

• AuthenticationNot required

  No account or session credential of any kind is needed; the exploit is available to any unauthenticated visitor who can reach the service.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit is fully self-contained and requires no action from a logged-in user or administrator.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must meet specific environmental or timing conditions, such as correctly predicting file paths or chaining with other server-side behaviors, rather than firing a simple repeatable payload.

Blast Radius

• A successful attacker reads arbitrary files from the server filesystem, including WordPress configuration files that contain database credentials, secret keys, and API tokens.
• The attacker can tamper with application data or inject content by leveraging included files that are executed server-side, potentially modifying persisted records or site behavior.
• Full availability impact means the attacker can crash or render the affected WordPress installation completely unresponsive.