CVE-2026-39623

HighCVSS 7.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

Summary

The Biolife WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.

Risk Assessment

The risk includes reading sensitive data like database configuration files, potentially leading to site takeover.

Recommendation

Update the Biolife theme to a version newer than 3.2.3 or apply temporary WAF rules blocking suspicious requests.

Other vulnerabilities in Biolife

CVE-2026-39624Medium
The Biolife WordPress theme has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.2.3.

Original NVD description (English source)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Biolife biolife allows PHP Local File Inclusion.This issue affects Biolife: from n/a through <= 3.2.3.