Is CVE-2026-39590 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39590 being exploited in the wild.

How severe is CVE-2026-39590?

High severity, with a CVSS score of 8.1, published 17 June 2026.

Is there a fix for CVE-2026-39590?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-39590 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-39590?

Check whether you run ThemeMove Atomlab at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39590: ThemeMove Atomlab Local File Inclusion

CVE-2026-39590 · Severity: high · CVSS 8.1 · Published 2026-06-17

Atomlab, a professional WordPress theme used for building business websites, contains a security flaw that allows unauthorized users to access sensitive internal files. An attacker could exploit this to steal configuration data, such as database passwords, potentially leading to a full takeover of the website and its data. This vulnerability is considered high priority as it can be exploited remotely without any login credentials.

Vendors: ThemeMove.

Quick answers

Is CVE-2026-39590 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39590 being exploited in the wild.
How severe is CVE-2026-39590?: High severity, with a CVSS score of 8.1, published 17 June 2026.
Which products and versions are affected?: ThemeMove Atomlab <= 2.4.5.
Is there a fix for CVE-2026-39590?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-39590 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-39590?: Check whether you run ThemeMove Atomlab at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Local File Inclusion (LFI) vulnerability exists in the ThemeMove Atomlab theme for WordPress through version 2.4.5. The flaw stems from improper control of filenames in PHP 'include' or 'require' statements (CWE-98), allowing an unauthenticated attacker to specify local files for execution or display. While the CVSS vector indicates high complexity (AC:H), a successful exploit enables the attacker to retrieve sensitive information like wp-config.php or system files, which can lead to remote code execution or full site compromise. The issue is resolved in version 2.4.6.

Affected products

ThemeMove Atomlab <= 2.4.5

Timeline

2026-02-20: other: Reported by researcher João Pedro S Alcântara (Kinorth)
2026-04-20: disclosed: Initial disclosure by Patchstack
2026-06-17: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.