CVE-2026-78566

Name of the Vulnerable Software and Affected Versions Shuffle versions prior to 1.9

Description The Shuffle theme for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, enabling the execution of PHP code within those files. This issue can be leveraged to bypass access controls, retrieve sensitive data, or achieve remote code execution if images or other seemingly safe file types can be uploaded and subsequently included.

Recommendations Update the Shuffle theme to a version newer than 1.8.