CVE-2026-66671: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in Elated-Themes Verdure Core

This vulnerability, identified as CWE-98, affects Verdure Core versions <= 1.2. It arises from improper validation of filenames in PHP include/require statements, enabling unauthenticated attackers to perform Local File Inclusion. The CVSS 3.1 score is 8.1, indicating high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. No official patch or remediation has been documented yet, and no known exploits are reported in the wild.

Successful exploitation can lead to disclosure of sensitive files, remote code execution, and full compromise of the affected system. The vulnerability is exploitable remotely without authentication but requires high attack complexity. The impact affects confidentiality, integrity, and availability at a high level.

No official patch or remediation level has been provided by the vendor at this time. Users should monitor the vendor's advisories for updates and consider applying any forthcoming patches promptly. Until a fix is available, restricting access to vulnerable endpoints and employing web application firewalls to detect and block suspicious file inclusion attempts may reduce risk.