CVE-2026-39590: WordPress Atomlab theme <= 2.4.5 - Local File Inclusion vulnerability

Synopsis

A local file inclusion vulnerability affects the Atomlab WordPress theme at version 2.4.5 and earlier. The flaw is reachable over the network without any authentication, though exploitation requires meeting certain environmental conditions due to a high attack complexity rating. A successful attacker can read arbitrary files from the server, tamper with data, and potentially disrupt availability of the affected site. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress site via standard HTTP/S to attempt exploitation.

• AuthenticationNot required

  No account or session credential of any kind is needed; the vulnerable code path is accessible to unauthenticated requests.

• Victim interactionNot required

  No action from a site user or administrator is required for the attacker to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must satisfy specific environmental conditions or timing factors beyond their direct control before exploitation succeeds reliably.

Blast Radius

• A successful attacker reads arbitrary files from the server filesystem, including WordPress configuration files that contain database credentials and secret keys.
• With access to credentials and sensitive config, the attacker can modify persisted database rows, injecting content or altering site data.
• Full confidentiality, integrity, and availability impact ratings indicate the attacker disrupts or crashes the affected service in addition to reading and modifying data.
• Exposure of secret keys and credentials enables further lateral movement into connected services or infrastructure beyond the WordPress host itself.