CVE-2026-42382: Audrey Path Traversal Vulnerability

CVE-2026-42382 Overview

CVE-2026-42382 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting the Audrey WordPress theme in versions 1.5 and earlier. The flaw is classified under CWE-98, which covers improper control of filename for include/require statements in PHP programs. Attackers can exploit this weakness over the network without authentication or user interaction. Successful exploitation allows adversaries to include arbitrary local files, potentially exposing sensitive configuration data or executing PHP code hosted on the server.

Critical Impact
Remote attackers can read sensitive files such as wp-config.php and, under favorable conditions, achieve code execution on WordPress installations running the vulnerable Audrey theme.

Affected Products

Audrey WordPress theme, versions 1.5 and prior
WordPress installations with the Audrey theme active
Hosting environments serving PHP-based WordPress sites using this theme

Discovery Timeline

2026-07-02 - CVE-2026-42382 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-42382

Vulnerability Analysis

The Audrey theme accepts attacker-controlled input into a PHP include or require statement without sufficient validation. This behavior matches CWE-98, PHP Remote File Inclusion, and permits Local File Inclusion when the parameter references a path on the local filesystem. Because the vulnerable endpoint requires no authentication, any remote actor can send crafted HTTP requests to trigger file inclusion. The vulnerability affects all versions of the theme up to and including 1.5.

Root Cause

The root cause is unsafe use of user-supplied data inside a PHP include, require, include_once, or require_once statement. The theme fails to enforce an allowlist of permitted files and does not sanitize path traversal sequences such as ../. As a result, the include target resolves to arbitrary files on the server. Sensitive WordPress files, including wp-config.php, may be exposed, and log poisoning techniques can escalate the issue toward code execution.

Attack Vector

Exploitation occurs over the network by sending HTTP requests to a vulnerable theme endpoint with a manipulated parameter. Attackers supply relative or absolute paths pointing to local files, and the PHP interpreter reads and evaluates the referenced content. The attack complexity is rated high because reliable exploitation typically depends on the target environment, such as the presence of readable logs, uploaded files, or specific PHP configuration options. No authentication, session, or user interaction is required.

See the Patchstack Audrey Theme Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-42382

Indicators of Compromise

HTTP requests to Audrey theme paths under /wp-content/themes/audrey/ containing path traversal patterns such as ../../ or encoded variants like %2e%2e%2f
Requests referencing sensitive files such as wp-config.php, /etc/passwd, or PHP session files in query parameters
Unexpected read access to WordPress log files or upload directories immediately preceded by theme requests
Web server error entries indicating failed include() or require() calls originating from the Audrey theme

Detection Strategies

Inspect web server and WordPress access logs for parameter values containing directory traversal sequences targeting the Audrey theme
Correlate anomalous PHP include/require warnings with inbound HTTP requests to theme endpoints
Deploy web application firewall (WAF) rules matching CWE-98 patterns, including null byte injection and encoded traversal
Monitor filesystem access telemetry for the web server user reading files outside the WordPress webroot

Monitoring Recommendations

Enable verbose PHP error logging and forward logs to a centralized SIEM for correlation
Track outbound connections from the web server process for signs of secondary payload retrieval
Alert on any HTTP response returning contents that resemble PHP configuration constants such as DB_PASSWORD

How to Mitigate CVE-2026-42382

Immediate Actions Required

Deactivate the Audrey theme on any WordPress site running version 1.5 or earlier until a fixed release is applied
Restrict access to the site through a WAF that blocks path traversal and LFI payload signatures
Rotate credentials stored in wp-config.php if exploitation is suspected, including database, salts, and API keys
Audit web server logs for prior requests matching the indicators listed above

Patch Information

Refer to the Patchstack Audrey Theme Vulnerability advisory for the latest vendor guidance and fixed version availability. Update the theme to the patched release as soon as it is published by the vendor. If no patched version is available, remove the theme and migrate to a maintained alternative.

Workarounds

Set the PHP open_basedir directive to restrict file inclusion to the WordPress root directory
Disable allow_url_include and allow_url_fopen in php.ini to reduce exploitation surface
Apply file permission hardening so the web server user cannot read wp-config.php beyond what WordPress requires
Place the WordPress installation behind a reverse proxy or WAF with LFI rulesets enabled until patching is complete

bash

# Configuration example: php.ini hardening
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"