CVE-2026-39558 Elated-Themes CVE debrief

Who should care

Users of Malmö theme version <= 2.2 should be aware of this vulnerability and take necessary actions to mitigate it. This includes verifying their installations, applying patches or mitigations, and monitoring for suspicious activity. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize remediation efforts.

Technical summary

CVE-2026-39558 is an Unauthenticated Local File Inclusion vulnerability in Malmö theme versions <= 2.2. The CVSS score is 8.1, indicating a high severity. This vulnerability allows attackers to include local files without authentication, potentially leading to sensitive information disclosure or code execution. Users should verify their installations and apply patches or mitigations as needed.

Defensive priority

High priority due to high CVSS score and potential for exploitation.

Recommended defensive actions

• Inventory Malmö theme installations and verify version <= 2.2
• Apply vendor remediation or patches
• Monitor for suspicious activity
• Consider compensating controls
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from official CVE and NVD sources. Limited details available. The CVE record was published on 2026-06-17T13:20:20.443Z and has not been modified since then. The vulnerability affects Malmö theme versions <= 2.2. Users should verify their installations and apply patches or mitigations as needed.

Official resources