CVE-2026-78478 Elated-Themes CVE debrief

Who should care

Defenders responsible for WordPress installations using the Mane theme, version 1.7 or earlier, should assess exposure and apply remediation. This includes operators managing WordPress environments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and protecting against potential exploitation.

Why it matters

The Local File Inclusion vulnerability in the Mane theme for WordPress allows unauthenticated attackers to execute arbitrary PHP code, bypass access controls, and obtain sensitive data. Defenders should prioritize verifying exposure and applying vendor remediation.

• Execution of arbitrary PHP code
• Bypassing access controls to sensitive data
• Obtaining sensitive data through file inclusion
• Achieving code execution through included files

Technical summary

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. The vulnerability can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other 'safe' file types can be uploaded and included. Defenders should prioritize verifying exposure of WordPress installations using the Mane theme, version 1.7 or earlier, and applying vendor remediation.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the Mane theme, version 1.7 or earlier, and applying vendor remediation.

Recommended defensive actions

• Verify WordPress installations using the Mane theme, version 1.7 or earlier, and apply vendor remediation.
• Monitor for suspicious file inclusion attempts on the server.
• Restrict access to sensitive files and directories.
• Implement additional security measures, such as web application firewalls.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the Local File Inclusion vulnerability in the Mane theme for WordPress. The vendor, Elated-Themes, and security researchers at Wordfence have confirmed the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.