CVE-2026-78478
Received Received - Intake

Local File Inclusion in Mane WordPress Theme

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Wordfence

Description
The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-78478
EUVD
EUVD-2026-65303

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
themeforest the_mane to 1.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Mane WordPress theme has a Local File Inclusion vulnerability in versions up to 1.7. Unauthenticated attackers can include and execute arbitrary files on the server, allowing PHP code execution. This can lead to bypassing access controls, stealing sensitive data, or full system compromise if malicious files are uploaded.

Detection Guidance

Check for vulnerable Mane theme versions by inspecting WordPress installations. Look for files included via LFI in web server logs or suspicious PHP execution. Use commands like 'grep -r "include" /var/www/html' to search for file inclusion patterns.

Impact Analysis

If you use the Mane theme, attackers could access sensitive files, execute malicious code, or take over your WordPress site. This includes stealing user data, installing backdoors, or defacing the site. The impact depends on server configuration and uploaded files.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR or HIPAA. Data breaches may result in legal penalties, fines, or reputational damage due to non-compliance with data protection requirements.

Mitigation Strategies

Update the Mane theme to the latest version if available. If no update exists, remove the theme immediately. Restrict file uploads to prevent malicious file inclusion and monitor server logs for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78478. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart