PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39661 Magentech CVE debrief

A PHP Local File Inclusion (LFI) vulnerability exists in Magentech SW Core, a WordPress plugin component. The vulnerability stems from improper control of filenames in include/require statements (CWE-98), allowing attackers with low privileges to include local files via network access. Affected versions span from initial release through 1.7.18. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, low privileges required, no user interaction, and high impacts to confidentiality, integrity, and availability. The NVD currently lists this CVE as 'Deferred' status. No known exploitation in ransomware campaigns has been documented.

Vendor
Magentech
Product
SW Core
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-26
Advisory published
2026-05-26
Advisory updated
2026-05-26

Who should care

WordPress site administrators using Magentech SW Core plugin; security teams monitoring PHP application vulnerabilities; web application firewall operators; vulnerability management programs tracking WordPress ecosystem risks

Technical summary

The SW Core plugin for WordPress contains a PHP Local File Inclusion vulnerability in versions through 1.7.18. The flaw exists in the handling of filename parameters for PHP include/require statements without adequate validation. An attacker with low privileges can exploit this over the network to include arbitrary local files, potentially leading to sensitive information disclosure, code execution, or complete system compromise. The attack requires high complexity to exploit but yields high impact across confidentiality, integrity, and availability dimensions.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade SW Core to a version newer than 1.7.18 if available from the vendor
  • Review application code for unsafe include/require statements that accept user-controlled filenames
  • Implement input validation and sanitization for all file path parameters
  • Apply principle of least privilege to web server file system access
  • Monitor for anomalous file access patterns in web application logs
  • If patching is not immediately available, consider Web Application Firewall (WAF) rules to detect and block LFI attack patterns
  • Review Patchstack advisory for additional technical details and verification of fixed versions

Evidence notes

Vulnerability classification sourced from NVD record with CVSS 3.1 scoring. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) confirmed via NVD weaknesses field. Vendor attribution to 'Magentech' and product 'SW Core' derived from CVE description and Patchstack reference. Version range 'n/a through 1.7.18' explicitly stated in CVE description. NVD status 'Deferred' noted in source metadata. No CISA KEV entry present.

Official resources

2026-05-26