CVE-2026-39559

Name of the Vulnerable Software and Affected Versions Uppercase versions prior to 1.2.2

Description An unauthenticated Local File Inclusion (LFI) exists in the Uppercase theme for WordPress. LFI is a vulnerability that allows an attacker to include files on the server that are outside the application's intended directory. This flaw enables unauthenticated attackers to include and execute arbitrary files, potentially leading to the execution of PHP code. This can be leveraged to bypass access controls or obtain sensitive data, particularly if images or other safe file types can be uploaded and subsequently included.

Recommendations Update to version 1.2.2 or later.