CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

VariantDraftLikelihood: High

Description

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

In certain versions and configurations of PHP, this can allow an attacker to specify a URL to a remote location from which the product will obtain the code to execute. In other cases in association with path traversal, the attacker can specify a local file that may contain executable statements that can be parsed by PHP.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-193

CVEs mapped to this weakness (1,304)

page 7 of 66

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2026-78478	WordPress Mane	Hig	0.53	8.1	Aug 25, 2026	The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This…
CVE-2026-66671	WordPress Verdure Core	Hig	0.53	8.1	Aug 24, 2026	Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
CVE-2026-66670	WordPress Måne	Hig	0.53	8.1	Aug 24, 2026	Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
CVE-2026-28152	WordPress Tonda Core	Hig	0.53	8.1	Aug 24, 2026	Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.
CVE-2026-28151	WordPress Tonda	Hig	0.53	8.1	Aug 24, 2026	Unauthenticated Local File Inclusion in Tonda < 2.6 versions.
CVE-2026-28150	WordPress Golo Framework	Hig	0.53	8.1	Aug 20, 2026	Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.
CVE-2025-15637	WordPress Shuffle	Hig	0.53	8.1	Aug 20, 2026	Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
CVE-2026-73387	WordPress Resido	Hig	0.53	8.1	Aug 19, 2026	Unauthenticated Local File Inclusion in Resido <= 1.5 versions.
CVE-2026-73400	WordPress Restaurant Menu by MotoPress	Hig	0.53	8.1	Aug 18, 2026	Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.
CVE-2026-32464	WordPress Theme Test Drive	Hig	0.53	8.1	Aug 18, 2026	Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.
CVE-2026-28570	WordPress Vavo Core	Hig	0.53	8.1	Aug 18, 2026	Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.
CVE-2026-66657	WordPress Biagiotti Core	Hig	0.53	8.1	Aug 13, 2026	Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.
CVE-2026-66656	WordPress Foton Core	Hig	0.53	8.1	Aug 13, 2026	Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.
CVE-2026-66653	WordPress Barista	Hig	0.53	8.1	Aug 13, 2026	Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.
CVE-2026-66450	WordPress Geo Mashup	Hig	0.53	8.1	Aug 13, 2026	Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.
CVE-2026-66710	WordPress E2pdf	Hig	0.53	8.1	Aug 6, 2026	Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.
CVE-2026-40731	WordPress ChapterOne	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.
CVE-2026-39582	WordPress XTS Hitek	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.
CVE-2026-39568	WordPress Mr Seo	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.
CVE-2026-39558	WordPress Malmö	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.

CVE-2026-78478HigAug 25, 2026
WordPress
Mane
risk 0.53cvss 8.1epss 0.00
The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This…
CVE-2026-66671HigAug 24, 2026
WordPress
Verdure Core
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
CVE-2026-66670HigAug 24, 2026
WordPress
Måne
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
CVE-2026-28152HigAug 24, 2026
WordPress
Tonda Core
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.
CVE-2026-28151HigAug 24, 2026
WordPress
Tonda
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Tonda < 2.6 versions.
CVE-2026-28150HigAug 20, 2026
WordPress
Golo Framework
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.
CVE-2025-15637HigAug 20, 2026
WordPress
Shuffle
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
CVE-2026-73387HigAug 19, 2026
WordPress
Resido
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Resido <= 1.5 versions.
CVE-2026-73400HigAug 18, 2026
WordPress
Restaurant Menu by MotoPress
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.
CVE-2026-32464HigAug 18, 2026
WordPress
Theme Test Drive
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.
CVE-2026-28570HigAug 18, 2026
WordPress
Vavo Core
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.
CVE-2026-66657HigAug 13, 2026
WordPress
Biagiotti Core
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.
CVE-2026-66656HigAug 13, 2026
WordPress
Foton Core
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.
CVE-2026-66653HigAug 13, 2026
WordPress
Barista
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.
CVE-2026-66450HigAug 13, 2026
WordPress
Geo Mashup
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.
CVE-2026-66710HigAug 6, 2026
WordPress
E2pdf
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.
CVE-2026-40731HigJun 17, 2026
WordPress
ChapterOne
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.
CVE-2026-39582HigJun 17, 2026
WordPress
XTS Hitek
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.
CVE-2026-39568HigJun 17, 2026
WordPress
Mr Seo
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.
CVE-2026-39558HigJun 17, 2026
WordPress
Malmö
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.