# CVE-2026-65477: Select-Themes Tonda Core local file inclusion in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-65477-select-themes-tonda-core-local-file-inclusion-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65477 · Severity: high · CVSS 7.5 · Published 2026-07-23

Tonda Core, a WordPress plugin, contains a security flaw that allows users with 'Contributor' level access to view sensitive files on the web server. An attacker could use this to steal database credentials or other configuration details, potentially leading to a full takeover of the website. No official patch has been released, so administrators should monitor for unauthorized file access or consider alternative solutions.

Vendors: [Select-Themes](https://junglewise.ai/threats/vendors/select-themes).

## Quick answers

**Is CVE-2026-65477 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65477 being exploited in the wild.

**How severe is CVE-2026-65477?** High severity, with a CVSS score of 7.5, published 23 July 2026.

**Which products and versions are affected?** Select-Themes Tonda Core <= 2.1.2.

**Is there a fix for CVE-2026-65477?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65477 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65477?** Check whether you run Select-Themes Tonda Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Local File Inclusion (LFI) vulnerability exists in the Tonda Core plugin for WordPress (versions 2.1.2 and below) due to improper control of filenames in PHP include/require statements (CWE-98). The vulnerability requires 'Contributor' level authentication and is characterized by a high complexity (AC:H) according to the CVSS vector. An attacker can exploit this to include and execute local files on the server, potentially leading to the disclosure of sensitive information like wp-config.php or remote code execution if combined with other techniques. As of the advisory date, no official patch is available.

## Affected products

- Select-Themes Tonda Core <= 2.1.2

## Timeline

- 2026-01-20: other: Reported by researcher João Pedro S Alcântara (Kinorth)
- 2026-07-22: advisory: Patchstack advisory published
- 2026-07-23: disclosed: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/tonda-core/vulnerability/wordpress-tonda-core-plugin-2-1-2-local-file-inclusion-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/tonda-core/vulnerability/wordpress-tonda-core-plugin-2-1-2-local-file-inclusion-vulnerability?_s_id=cve)