CVE-2026-78478: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in Elated-Themes Mane

CVE-2026-78478 is a Local File Inclusion vulnerability (CWE-98) in the Mane WordPress theme by Elated-Themes affecting all versions up to 1.7. The flaw allows unauthenticated attackers to include arbitrary files via improper control of filename input in include/require statements. This can lead to execution of arbitrary PHP code, bypassing access controls and exposing sensitive information. The vulnerability has a CVSS 3.1 score of 8.1, indicating high severity. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation enables unauthenticated attackers to execute arbitrary PHP code on the affected server, potentially leading to full system compromise, data disclosure, and bypass of security controls. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Mane theme if possible. Restricting file upload types and hardening server configurations may reduce risk but do not fully mitigate the vulnerability.