CVE-2026-39568: WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability

Synopsis

This is a Local File Inclusion (LFI) vulnerability in the Mr. SEO WordPress theme by Elated-Themes, affecting all versions up to and including 2.0. The flaw is reachable over the network without any authentication, though exploitation requires overcoming certain environmental conditions (high attack complexity per the CVSS rating). A successful attacker can read sensitive files from the server, tamper with data, and disrupt service availability. HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or session token is needed; the vulnerable code path is accessible to unauthenticated HTTP requests.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the server without involving any end-user.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must account for specific environmental conditions or configuration factors that are not fully under their control.

Blast Radius

• A successful attacker can read arbitrary files from the server filesystem, including WordPress configuration files containing database credentials and secret keys.
• Sensitive files such as /etc/passwd, application secrets, or private certificates stored on the host become readable.
• With high integrity impact confirmed by the CVSS score, an attacker can modify or overwrite server-side content or configuration.
• The availability impact is rated high, meaning the attacker can crash or render the affected WordPress service unresponsive.