CVE-2026-39538

HighCVSS 7.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

Summary

The Mikado Core WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.

Risk Assessment

The risk includes reading sensitive data like configuration files, potentially leading to privilege escalation.

Recommendation

Update the Mikado Core plugin to a version newer than 1.6 or apply temporary blocking rules.

Other vulnerabilities in Mikado Core

CVE-2026-39537High
Mikado Core versions up to 1.6 are vulnerable to unauthenticated local file inclusion.

Original NVD description (English source)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Mikado Core mikado-core allows PHP Local File Inclusion.This issue affects Mikado Core: from n/a through <= 1.6.