CVE-2026-66670: Måne Path Traversal Vulnerability

CVE-2026-66670 Overview

CVE-2026-66670 is an unauthenticated Local File Inclusion (LFI) vulnerability in the Måne WordPress theme, affecting versions up to and including 1.7. The flaw is categorized under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). Remote attackers can influence file paths passed to PHP include or require statements without authentication. Successful exploitation exposes local file contents and can lead to code execution when attacker-controlled content reaches the include path.

Critical Impact
Unauthenticated attackers can read sensitive server files and potentially execute arbitrary PHP code hosted on the target server through a WordPress theme running Måne 1.7 or earlier.

Affected Products

Måne WordPress theme, versions 1.7 and earlier
WordPress installations with the Måne theme active
Sites that inherit vulnerable theme files through child themes of Måne

Discovery Timeline

2026-08-24 - CVE-2026-66670 published to the National Vulnerability Database
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-66670

Vulnerability Analysis

The Måne theme includes PHP files based on user-controllable input without adequate validation or path sanitization. An unauthenticated attacker crafts an HTTP request that supplies a filename or path parameter, which the theme passes directly to a PHP include, include_once, require, or require_once statement. The application then loads and executes the referenced file within the WordPress process context.

Because the include target is attacker-controlled, the impact extends beyond information disclosure. When combined with log poisoning, session file writes, or upload primitives elsewhere in the site, the LFI becomes a full remote code execution primitive. The vulnerability is exploitable over the network, requires no privileges, and requires no user interaction.

Root Cause

The root cause is improper control of the filename passed to a PHP include statement, tracked as CWE-98. The theme neither restricts include targets to an allowlist nor normalizes the path to prevent traversal sequences such as ../. Null-byte and wrapper-based bypasses may also apply depending on the PHP configuration.

Attack Vector

An attacker issues a crafted HTTP GET or POST request to a Måne theme endpoint that accepts a file path parameter. The parameter references either a local file such as /etc/passwd, wp-config.php, or a log file whose contents the attacker has previously poisoned with PHP code. The theme includes the referenced file, disclosing its contents in the response or executing embedded PHP.

Refer to the Patchstack WordPress Vulnerability Report for the underlying advisory details.

Detection Methods for CVE-2026-66670

Indicators of Compromise

HTTP request parameters containing path traversal sequences such as ../, ..%2f, or absolute paths targeting the WordPress document root
Access log entries referencing sensitive files including wp-config.php, /etc/passwd, /proc/self/environ, or PHP session files
Unexpected inclusion of log files, uploaded images, or temporary files by PHP processes serving theme URLs
Outbound network connections initiated by the PHP-FPM or Apache worker after requests to Måne theme endpoints

Detection Strategies

Inspect web server logs for requests to Måne theme scripts that contain file, page, template, or path parameters with directory traversal patterns
Deploy Web Application Firewall (WAF) rules that block PHP wrapper schemes such as php://filter, php://input, data://, and expect:// in query strings
Correlate WordPress theme requests with file read syscalls on sensitive paths using endpoint telemetry

Monitoring Recommendations

Alert on any HTTP response returning content that matches signatures of wp-config.php, /etc/passwd, or PHP source code
Monitor for new or modified PHP files under wp-content/uploads/ that could serve as staged include targets
Track PHP process command execution and outbound connections following requests to the Måne theme

How to Mitigate CVE-2026-66670

Immediate Actions Required

Deactivate and remove the Måne theme from any WordPress site until a patched version is confirmed by the vendor
Switch active sites to a maintained default theme such as Twenty Twenty-Four while remediation is in progress
Rotate secrets stored in wp-config.php, including database credentials and authentication keys, if exploitation is suspected
Audit wp-content/uploads/ and web-accessible log directories for planted PHP payloads

Patch Information

No fixed version is listed in the enriched CVE data at the time of publication. Consult the Patchstack WordPress Vulnerability Report for the latest vendor status and upgrade guidance.

Workarounds

Add WAF rules that reject requests to Måne theme paths containing ../, null bytes, or PHP stream wrappers
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to block remote inclusion escalation
Restrict open_basedir in the PHP configuration to the WordPress installation directory to limit file read scope
Disable dangerous PHP functions such as system, exec, and passthru via the disable_functions directive

bash

# Configuration example
# /etc/php/8.2/fpm/php.ini hardening for LFI containment
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = system,exec,passthru,shell_exec,popen,proc_open

# Example ModSecurity rule to block traversal on theme paths
SecRule REQUEST_URI "@contains /wp-content/themes/mane/" \
  "chain,id:1026066670,phase:2,deny,status:403,msg:'Blocked Mane LFI attempt'"
  SecRule ARGS "@rx (\.\./|\.\.%2f|php://|data://|expect://)" "t:lowercase,t:urlDecodeUni"