The vulnerability CVE-2026-39684 in UnTheme OrganicFood (<= 3.6.4) arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker with low privileges to perform Local File Inclusion (LFI), potentially leading to arbitrary code execution or unauthorized file access. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented, and no exploits are known in the wild.

Successful exploitation could allow an attacker to include and execute arbitrary local files on the server, compromising confidentiality, integrity, and availability of the affected system. This may lead to unauthorized data disclosure, code execution, or service disruption. The vulnerability requires low privileges but has high attack complexity, reducing the likelihood of widespread exploitation without additional conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the affected application, apply strict input validation or filtering on filename parameters if possible, and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable application to untrusted networks or users.