Local File Inclusion Vulnerability in Shuffle WordPress Theme

The Shuffle theme for WordPress, developed by Edge-Themes, is susceptible to a Local File Inclusion (LFI) vulnerability identified as CVE-2026-78566. The vulnerability affects all versions up to and including 1.8. An unauthenticated attacker can exploit this flaw to include and execute arbitrary files stored on the underlying web server. This vulnerability, categorized as CWE-98, poses a significant risk to affected installations, as successful exploitation enables the execution of arbitrary PHP code, potentially leading to a full system compromise. The impact includes the ability to bypass access controls, exfiltrate sensitive application data, or achieve Remote Code Execution (RCE) if the environment allows for the uploading of files (such as images) that can then be processed via the LFI vector.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server hosting the WordPress instance. This can lead to unauthorized access to the WordPress database, configuration files, and credentials stored in the application environment. If the server is not properly hardened, this vulnerability may lead to full web shell deployment and persistent access by an adversary.

Recommendation

• Identify all WordPress installations within the environment utilizing the Shuffle theme by Edge-Themes.
• Update the Shuffle theme to the latest patched version immediately.
• If an update is unavailable, audit web server logs for suspicious requests containing directory traversal sequences (e.g., ../) in common URL parameters associated with theme file inclusion.
• Restrict the ability of the web server user to read files outside of the defined document root.
• Deploy the provided Sigma rule to detect attempts to exploit LFI vulnerabilities in web applications.