WordPress Shuffle Theme Has an Unauthenticated PHP File Inclusion Bug

• The Mess: A new Shuffle WordPress theme vulnerability, tracked as CVE-2026-78566, allows an unauthenticated attacker to abuse Local File Inclusion and potentially execute PHP code on the server. The flaw affects Shuffle 1.8 and earlier and carries a CVSS 8.1 score.

The problem is classic PHP territory: an attacker can influence a filename used by a PHP include or require operation.

That sounds boring.

It isn’t.

The vulnerable theme can be abused to include files that should never be treated as executable PHP. Under the right conditions, an attacker can upload a file that looks harmless — an image, for example — and then abuse the inclusion flaw to make the server process PHP code contained inside it.

That creates a nasty escalation path.

A file upload bug becomes a file inclusion bug. The file inclusion bug becomes code execution.

Suddenly a WordPress theme is trying to become a remote shell.

The vulnerability was publicly disclosed on August 25, 2026, so this is a genuinely fresh addition to the vulnerability pile. There is currently no confirmed public PoC or evidence of exploitation, which gives administrators a little breathing room. Not much.

The affected product is Shuffle by Edge-Themes, with versions up to and including 1.8 listed as vulnerable.

• The Damage: An unauthenticated attacker may be able to read sensitive server data or achieve arbitrary PHP code execution, potentially turning a vulnerable WordPress site into a fully compromised server.

And WordPress servers are rarely isolated little islands.

They contain configuration files, database credentials, API keys, uploaded documents, administrator accounts and other plugins. A successful PHP execution bug can therefore be the first step toward a much larger compromise.

There is also the usual hosting problem.

If the WordPress installation shares infrastructure with other applications, an attacker who gets code execution may start looking for ways to move beyond the original site.

The CVSS vector is worth noticing: network exploitable, no privileges required and no user interaction required. The catch is the high attack complexity, which keeps the score at 8.1 rather than pushing it into critical territory.

That does not make the bug harmless.

It just means exploitation isn’t necessarily one-click.

• The Fix: Update Shuffle to version 1.8.1 or later, restrict access to upload directories, verify uploaded file types, and use WAF rules to block suspicious Local File Inclusion requests until every affected installation is patched.

Administrators should also check whether the vulnerable theme is actually installed and active.

And if the site was exposed while running Shuffle 1.8 or earlier, inspect logs for unusual requests and look for unexpected PHP files in upload directories.

There is no confirmed exploitation right now.

That’s good.

Waiting for the first webshell to appear before patching would be less good.

Bugstoday Opinion

This is another WordPress reminder that “it’s only a theme” is not a security strategy.

A theme gets access to the application. The application can process files. PHP can execute code.

That’s a dangerous chain when one filename ends up under an attacker’s control.

The lack of a public exploit is the good news.

The bad news is that CVE-2026-78566 is now public knowledge, and attackers don’t need a particularly creative idea to understand what Local File Inclusion plus PHP execution can mean.

Bugstoday verdict: 1.8 is old news. Update Shuffle, lock down uploads, and don’t wait for someone to turn your WordPress theme into a webshell.