CVE-2026-52707: WordPress Kastell theme <= 2.0 - Local File Inclusion vulnerability

Synopsis

A local file inclusion vulnerability affects the Kastell WordPress theme at version 2.0 and below. The flaw is reachable over the network without any authentication, though exploitation requires overcoming environmental conditions tied to high attack complexity. A successful attacker can read arbitrary files from the server, modify data, and crash the affected service. No upstream patch has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable theme endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session credential is needed; the vulnerability is exploitable by any unauthenticated request.

• Victim interactionNot required

  No user action is required; the attacker sends crafted requests directly to the server without involving any logged-in user.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must satisfy specific environmental conditions or timing constraints beyond simple request crafting, such as particular server configurations or path traversal prerequisites.

Blast Radius

• Reads arbitrary files from the server filesystem, including WordPress configuration files containing database credentials and secret keys.
• Reads sensitive operating system files such as /etc/passwd or application secrets stored outside the web root.
• Depending on server configuration, may enable writing or overwriting files on the server, altering application behavior or injecting malicious code.
• Can destabilize or crash the affected service if critical runtime files are corrupted or overwritten during exploitation.