PT-2026-23218 · Unknown · Fuelthemes

João Pedro S Alcântara + 1 · Published 2026-03-05 · Updated 2026-03-07 · CVE-2026-23801

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions fuelthemes versions prior to 1.6.11

Description The software contains an Improper Control of Filename for Include/Require Statement issue, also known as PHP Remote File Inclusion. This allows for PHP Local File Inclusion. The vulnerable component is susceptible to exploitation through the inclusion of external files.

Recommendations Update fuelthemes to a version newer than 1.6.11.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-23801

Affected Products

Fuelthemes

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-23801 · Security Note
• https://patchstack.com/database/Wordpress/Theme/theissue/vulnerability/wordpress-the-issue-theme-1-6-11-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/infoflowcloud/status/2030387151037255891 · Twitter Post
• https://twitter.com/CVEnew/status/2030385232742936595 · Twitter Post