PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40721 BdThemes CVE debrief

CVE-2026-40721 is a HIGH severity vulnerability (CVSS Score: 7.5) in Element Pack Pro plugin versions <= 9.0.6. This vulnerability allows for local file inclusion attacks, potentially enabling attackers to access sensitive files on the server. The vulnerability was published on June 17, 2026, and last modified on the same day. Users of Element Pack Pro should update to a patched version to mitigate this risk.

Vendor
BdThemes
Product
Element Pack Pro
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-17
Advisory published
2026-06-17
Advisory updated
2026-06-17

Who should care

Administrators and users of Element Pack Pro plugin versions <= 9.0.6 should be aware of this vulnerability and take immediate action to update to a patched version. Additionally, security teams and vulnerability managers should prioritize this vulnerability for remediation due to its HIGH severity.

Technical summary

CVE-2026-40721 is a local file inclusion vulnerability in Element Pack Pro plugin versions <= 9.0.6. This vulnerability allows an attacker to include files on the server, potentially leading to sensitive information disclosure or code execution. The vulnerability has a CVSS Score of 7.5 and a CVSS Severity of HIGH. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

HIGH

Recommended defensive actions

  • Update Element Pack Pro plugin to a patched version (> 9.0.6)
  • Review server logs for suspicious file inclusion attempts
  • Implement additional security measures to restrict file access
  • Monitor for potential exploitation attempts
  • Consider using a Web Application Firewall (WAF) to detect and prevent attacks
  • Keep software and plugins up-to-date with the latest security patches

Evidence notes

The vulnerability was reported by Patchstack and is listed in the NVD database. The CVE record was published on June 17, 2026, and last modified on the same day. The vulnerability has a CWE-98 classification.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40721 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40721

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40721 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40721

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.