CVE-2026-66653

Name of the Vulnerable Software and Affected Versions Barista versions prior to 2.5.2

Description The Barista theme for WordPress allows unauthenticated attackers to include and execute arbitrary files on the server. This occurs through a Local File Inclusion (LFI) flaw, which is a vulnerability that allows an attacker to read or execute files on the server that they should not have access to. This can lead to the execution of arbitrary PHP code, bypassing access controls, and the theft of sensitive data, particularly if the attacker can upload files to the server.

Recommendations Update Barista to a version newer than 2.5.1.