Loading story…
Two high-severity vulnerabilities have been disclosed in commercial WordPress themes, exposing sites using ThemeREX Melania and gavias Kunco to local file inclusion (LFI) attacks. The issues are tracked as CVE-2026-22324 for Melania versions <= 2.5.0 and CVE-2026-32531 for Kunco versions < 1.4.5, and both stem from improper control of filenames in PHP include or require statements, mapped to CWE-98.
Both CVEs carry the same CVSS v3.1 vector, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable flaws with high potential impact to confidentiality, integrity, and availability despite higher attack complexity. Patchstack references were added for both vulnerabilities, pointing defenders to fixed versions and making theme updates a priority for WordPress administrators running affected Melania or Kunco deployments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE entry was recorded for a local file inclusion vulnerability in the gavias Kunco WordPress theme affecting versions earlier than 1.4.5. The flaw was mapped to CWE-98 and tied to improper control of filename in a PHP include/require statement.
A CVE entry for a PHP local file inclusion vulnerability in the ThemeREX Melania WordPress theme was received by Patchstack, affecting versions through 2.5.0. The issue was classified as CWE-98 and described as improper control of filename in an include/require statement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities have been disclosed in widely deployed WordPress plugins, exposing internet-facing sites to **unauthenticated compromise**. `CVE-2026-3584` affects **Kali Forms** through version `2.4.9` and allows **remote code execution** because user-controlled input can be mapped into internal placeholder storage and later invoked via `call_user_func` in the `form_process` path. The issue is classified as `CWE-94` and carries a `CVSS 3.1` score with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating critical impact on confidentiality, integrity, and availability. A second flaw, `CVE-2026-4038`, affects **Aimogen Pro** through version `2.7.5` and enables **unauthenticated privilege escalation** through an arbitrary function call in `aiomatic_call_ai_function_realtime` caused by a missing capability check. According to the disclosure, attackers can invoke WordPress functions such as `update_option` to change the default registration role to administrator and enable user registration, effectively creating a path to full site takeover. The vulnerability is tracked as `CWE-862` and was likewise rated with a high-impact `CVSS 3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in popular WordPress snippet-management plugins, exposing sites to **remote code execution** through `CWE-94` code injection flaws. `CVE-2026-25001` affects **Post Snippets** by Saad Iqbal in versions through `4.0.12`, while `CVE-2026-25366` affects **Woody ad snippets** (`insert-php`) by Themeisle in versions through `2.7.1`. Both issues were documented with Patchstack references and indicate that attackers could inject or include malicious code on vulnerable WordPress installations. The two CVEs differ in attack complexity but both carry severe impact to confidentiality, integrity, and availability. `CVE-2026-25001` is scored with `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`, while `CVE-2026-25366` carries `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`, making the Woody ad snippets flaw easier to exploit once low privileges are obtained. Organizations running either plugin should identify affected versions, prioritize updates beyond the vulnerable releases, and review WordPress environments for signs of unauthorized code execution.
Jun 29, 2026
Multiple WordPress plugins were found vulnerable to **unauthenticated arbitrary file upload** flaws that can lead to remote code execution and full site compromise. The most urgent case involves the **Breeze Cache** plugin, where **CVE-2026-3844** affects versions through `2.4.4` when the optional **"Host Files Locally - Gravatars"** feature is enabled. Researchers said the bug stems from missing file-type validation in the `fetch_gravatar_from_remote` function, and BleepingComputer reported that attackers are already exploiting the issue in the wild, with Wordfence observing more than 170 attack attempts. Cloudways released a fix in version `2.4.5`, and defenders were urged to update immediately or disable the Gravatar-related feature until patching is complete. Two additional **Contact Form 7** upload extensions were also disclosed with critical upload weaknesses. **CVE-2026-5718** affects **Drag and Drop Multiple File Upload for Contact Form 7** through `1.3.9.6`, where custom blacklist handling can override the default dangerous-extension denylist and a non-ASCII filename trick can bypass sanitization, allowing attackers to upload PHP files. **CVE-2026-5364** affects **Drag and Drop File Upload for Contact Form 7** through `1.1.3`, where the plugin validates an unsanitized extension but saves a sanitized one, enabling bypasses using special characters such as `$`; researchers noted that `.htaccess` protections and filename randomization may reduce real-world exploitability. Together, the disclosures highlight a broader pattern of insecure file validation in WordPress upload plugins.
Jun 29, 2026