Local File Inclusion Vulnerability in Mane WordPress Theme

The Mane theme for WordPress, developed by Elated-Themes, contains a critical Local File Inclusion (LFI) vulnerability identified as CVE-2026-78478. The flaw exists in all versions up to and including 1.7. This vulnerability allows an unauthenticated remote attacker to manipulate input parameters to include and execute arbitrary files present on the server. If an attacker can successfully upload a file to the server (e.g., via a profile picture upload or other media feature) or access existing configuration files, they can force the application to interpret that file as PHP code. Successful exploitation results in remote code execution (RCE) with the privileges of the web server process, potentially leading to total site compromise, data exfiltration, and administrative access bypass.

Impact

The vulnerability carries a CVSS 3.1 base score of 8.1, reflecting its high impact on confidentiality, integrity, and availability. Successful exploitation enables unauthenticated attackers to execute arbitrary code, bypass security controls, and access sensitive application data. The scope of impact includes any WordPress installation running the affected Mane theme version, which is widely used for portfolio and creative websites.

Recommendation

• Update the Mane WordPress theme to the latest version immediately to remediate the LFI vulnerability.
• Review web server access logs for anomalous URI requests containing directory traversal sequences (e.g., ../) or unusual file extensions in parameters.
• Audit the WordPress media library and upload directories for unauthorized or suspicious file uploads that could be leveraged as LFI targets.
• Deploy the provided WAF/IDS rules to detect and block exploitation attempts targeting the identified vulnerable theme parameters.