CVE-2026-94062: WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability
Published Oct 9, 2026
·Updated
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.
Affected Software
1 affected component
Fuelthemes Werkstatt<=4.8.3
Event History
Oct 9, 2026
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Fuelthemes Werkstatt versions through 4.8.3 are affected. The affected version range begins at an unspecified earlier version.
2
Does exploitation require an authenticated WordPress user or user interaction?
The supplied CVSS vector indicates no privileges are required and no user interaction is required. Exploitation is network-accessible, though the attack complexity is rated high.
3
What is the potential impact if exploited?
The supplied CVSS assessment rates confidentiality, integrity, and availability impacts as high. The vulnerability is a PHP local file inclusion issue.