CVE-2026-39538

HighCVSS 7.5/10Last modified Jul 24, 2026

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Mikado Core mikado-core allows PHP Local File Inclusion.This issue affects Mikado Core: from n/a through <= 1.6.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-395398.1Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.CVE-2026-39546.5A weakness has been identified in OpenBMB XAgent 1.0.0. Affected by this vulnerability is the function workspace of the file XAgentServer/ap CVE-2026-395406.5Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.CVE-2026-395415.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking a CVE-2026-395425.3Insertion of Sensitive Information Into Sent Data vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retr CVE-2026-395435.3Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2026-395447.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek LabtechCO CVE-2026-395458.1Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.CVE-2026-395467.6Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.CVE-2026-395478.1Unauthenticated Local File Inclusion in Getaway < 1.8 versions.CVE-2026-395487.1Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.CVE-2026-395498.1Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.