CVE-2026-39582: WordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerability

Synopsis

This is a Local File Inclusion (LFI) vulnerability in the WordPress Hitek theme by xtemos, affecting all versions below 1.8.3. The flaw is reachable over the network and requires no authentication, meaning any remote visitor can trigger it. Successful exploitation gives an attacker full read access to arbitrary files on the server, the ability to tamper with data, and the ability to crash or destabilize the service. A patched-image rebuild at version 1.8.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress service via HTTP or HTTPS.

• AuthenticationNot required

  No account or session token is needed; the exploit can be triggered by any unauthenticated HTTP request.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the request is sent directly to the server.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation depends on environmental conditions such as specific server configurations or race conditions that the attacker cannot fully control.

Blast Radius

• A successful attacker reads arbitrary files from the server filesystem, including configuration files that contain database credentials and API keys.
• The attacker gains the ability to modify or overwrite data accessible to the web server process.
• The attacker can disrupt or crash the affected WordPress service, causing an outage for end users.