CVE-2026-23975: 
WordPress vulnerability analysis and mitigation

CVE-2026-23975 is a PHP Local File Inclusion (LFI) vulnerability in the uxper Golo WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Golo theme prior to 1.7.5 and was reported by researcher João Pedro S Alcântara (Kinorth) on January 6, 2026, with public disclosure on January 22, 2026. The vulnerability was assigned a CVSS v3.1 base score of 7.5 (High) by Patchstack, requiring low privileges and high attack complexity (Patchstack, NVD).

The root cause is improper validation and sanitization of user-supplied input used in PHP file inclusion operations (CWE-98), allowing an attacker to manipulate the filename parameter passed to a PHP include or require statement. Exploitation requires a low-privilege account (Contributor or Developer level) and is conducted over the network, though high attack complexity is noted. A successful attack causes the server to include and execute or expose arbitrary local files, such as configuration files containing database credentials. The vulnerability is classified under OWASP Top 10 category A3: Injection (Patchstack).

Successful exploitation allows an attacker to read sensitive local files on the web server, including files containing database credentials (e.g., wp-config.php), which could lead to complete database takeover. The vulnerability carries high impacts across confidentiality, integrity, and availability, potentially enabling unauthorized data access, content modification, and service disruption. Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity (Patchstack).

There is no known public proof-of-concept exploit or evidence of active in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.0015 (0.15%), indicating a low current probability of exploitation. The vulnerability requires at least Contributor-level privileges and high attack complexity, which somewhat limits opportunistic exploitation. It has been detected by Qualys (detection ID 530924) and is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Golo theme (versions < 1.7.5) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Obtain low-privilege access: Acquire or create a Contributor or Developer-level WordPress account on the target site, either through credential stuffing, phishing, or registration if open.
3. Identify vulnerable parameter: Locate the theme functionality that accepts a filename or path parameter passed to a PHP include/require statement, typically through crafted HTTP requests to theme-specific endpoints or shortcodes.
4. Craft LFI payload: Submit a manipulated filename parameter (e.g., ../../../../wp-config.php) to traverse directories and reference sensitive local files.
5. Extract sensitive data: Review the server response for the contents of included files, such as database credentials from wp-config.php, enabling further compromise such as database access or privilege escalation (Patchstack).

• Network: Unusual HTTP requests containing directory traversal sequences (e.g., ../, %2e%2e%2f) in parameters associated with the Golo theme endpoints; repeated requests from a single IP to theme-related URLs with varying file path parameters.
• Logs: WordPress or web server access logs showing requests with path traversal patterns targeting Golo theme parameters; HTTP 200 responses to requests containing wp-config, passwd, or other sensitive file references.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php or /etc/passwd that correlate with suspicious web requests.
• Process: PHP processes reading files outside the WordPress web root directory, particularly system files or configuration files not normally accessed during regular theme operation.

The primary remediation is to update the Golo WordPress theme to version 1.7.5 or later, which contains the fix for this vulnerability (Patchstack). As interim mitigations, administrators should implement strict input validation and sanitization for all file inclusion operations, and deploy Web Application Firewall (WAF) rules to detect and block path traversal and LFI attempts. Access controls should be reviewed to limit the number of accounts with Contributor or higher privileges, and server logs should be monitored for signs of exploitation attempts.

Wordfence included this vulnerability in their weekly WordPress vulnerability report for February 2–8, 2026, and Qualys published it as part of their February 2026 application security detections (Wordfence, Qualys). Patchstack, the assigning CNA, classifies the vulnerability as low priority with unlikely exploitation impact, noting it has no active VDP program associated with the Golo theme. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.