CVE-2026-66670: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in Elated-Themes Måne

This vulnerability (CVE-2026-66670) in Elated-Themes Måne (<=1.7) is an unauthenticated local file inclusion flaw due to improper control of filenames used in PHP include/require statements (CWE-98). It allows remote attackers to include arbitrary local files on the server, which can lead to execution of malicious code or disclosure of sensitive information. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in full compromise of the affected system's confidentiality, integrity, and availability. Attackers can include arbitrary local files, potentially leading to remote code execution or sensitive data disclosure without requiring authentication.

No official patch or remediation level has been published yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.