CVE-2026-40731: WordPress ChapterOne theme <= 1.7 - Local File Inclusion vulnerability

Synopsis

This is a Local File Inclusion (LFI) vulnerability in the ChapterOne WordPress theme by Mikado-Themes, affecting all versions up to and including 1.7. The flaw is reachable over the network with no authentication required, though exploitation requires meeting specific environmental conditions. A successful attacker can read arbitrary files from the server, modify data, and disrupt service availability. HarborGuard is tracking the advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via standard HTTP/HTTPS traffic.

• AuthenticationNot required

  No account or session credentials are needed; the attacker can trigger the vulnerability as an unauthenticated visitor.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit is executed entirely by the attacker without victim participation.

• Attack complexityDetail

  Attack complexity is rated High, meaning the exploit is not condition-free and requires the attacker to meet specific environmental factors or timing constraints beyond the attacker's direct control.

Blast Radius

• Reads arbitrary files from the server filesystem, including WordPress configuration files that contain database credentials and secret keys.
• Gains write or modification capability against application data or server-side files, depending on file inclusion payload and server configuration.
• Can crash or destabilize the affected service, causing a disruption in availability for the WordPress site and any services it supports.
• Chained with a writable upload directory or other secondary condition, the LFI can escalate to remote code execution on the host.