CVE-2026-94062

Executive Summary

CVE-2026-94062 is a critical PHP Remote File Inclusion vulnerability (CWE-98) affecting Fuelthemes Werkstatt versions up to and including 4.8.3. The flaw stems from improper control of filenames used in PHP include/require statements, enabling local file inclusion (LFI) and, under certain server configurations, remote file inclusion (RFI). Successful exploitation allows an unauthenticated attacker to read sensitive files, execute arbitrary code, or fully compromise the underlying web server. With a CVSS score of 8.1 and no available patch, this vulnerability poses a severe risk to all organizations running the affected product.

Technical Analysis

The vulnerability is classified as CWE-98: "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')". In PHP applications, include/require statements dynamically incorporate external files into the execution flow. When user-supplied input is passed to these statements without proper sanitization—such as allowing directory traversal sequences (e.g., ../) or remote URLs—an attacker can influence which file is loaded.

The NVD description explicitly states that this issue allows "PHP Local File Inclusion." This indicates that the vulnerability permits an attacker to include local files from the server's filesystem, potentially leading to sensitive data exposure, code execution via log poisoning or file uploads, or further lateral movement. The title also references remote file inclusion, but the description emphasizes local file inclusion as the confirmed impact. The attack surface is the public-facing web application running the Werkstatt theme, where attacker-controlled input reaches a PHP include/require construct.

No further code-level detail (e.g., specific parameter names, file paths, or function calls) is provided in the NVD description or CNA title. Therefore, the exact mechanism—such as which parameter is vulnerable or which script invokes the include—cannot be confirmed from the available data. The vulnerability class is well understood: untrusted input reaching a filesystem or URL inclusion function without validation.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that exploitation is network-accessible, requires high attack complexity (AC:H), needs no privileges or user interaction, and results in high confidentiality, integrity, and availability impact. The high complexity may reflect the need for specific conditions (e.g., certain PHP configurations, file existence, or server settings) to achieve code execution versus simple file read. The score of 8.1 is consistent with a severe vulnerability that is not trivially exploitable but yields substantial impact.

Exploitation Scenarios

No public proof-of-concept or exploit code is available, and no Nuclei template exists. The following attack chain is inferred from the vulnerability class and the limited details provided.

1. Reconnaissance / Target Identification: The attacker identifies a web application running the Fuelthemes Werkstatt theme, version 4.8.3 or earlier. This can be done through fingerprinting (e.g., HTML source, static assets, or known paths) or by scanning for the product via search engines like Shodan using dorks such as http.html:"werkstatt". The attacker confirms the application is publicly accessible and that the PHP configuration permits file inclusion (e.g., allow_url_include for RFI, or local file read).

2. Triggering the Flaw: The vulnerability class is PHP file inclusion. The attacker must locate a parameter or input field that is passed unsanitized to an include/require statement. Since the NVD description does not specify the exact vulnerable parameter or endpoint, the attacker would typically fuzz common input vectors (GET/POST parameters, cookies, HTTP headers) or review the theme's source code if available. The high attack complexity (AC:H) suggests that the vulnerable code path may require specific conditions, such as a particular page, a crafted sequence of requests, or a specific server configuration.

3. Payload / Execution Method (Vulnerability-Class Level): For local file inclusion, the attacker supplies a path to a local file, potentially using directory traversal sequences (e.g., ../../../../etc/passwd) to read sensitive files. To escalate to remote code execution, the attacker might attempt to include a file hosted on an external server (if allow_url_include is enabled) or leverage a local file that contains attacker-controlled content (e.g., web server logs, uploaded images with embedded PHP code). The exact payload syntax depends on the vulnerable parameter, which is not disclosed. It is important to note that the description confirms local file inclusion; remote file inclusion may be possible but is not explicitly stated as the primary impact.

4. Post-Exploitation Impact: Successful LFI can lead to the disclosure of configuration files (e.g., wp-config.php in WordPress environments, since Werkstatt is a WordPress theme), database credentials, API keys, and other sensitive data. If code execution is achieved (via RFI or log poisoning), the attacker can run arbitrary PHP code, leading to full server compromise, installation of web shells, data exfiltration, or lateral movement within the network. The high integrity and availability impact reflect the potential to modify or destroy data and disrupt services.

Impact Assessment

The CVSS score of 8.1 (High) reflects a serious vulnerability. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H breaks down as follows:

• Attack Vector (AV:N): Exploitable over the network, typically via HTTP/HTTPS.
• Attack Complexity (AC:H): Exploitation requires specific conditions, such as a particular server configuration or the presence of a local file with attacker-controlled content. This reduces the likelihood of trivial exploitation but does not eliminate the threat.
• Privileges Required (PR:N): No authentication is needed; any remote attacker can attempt exploitation.
• User Interaction (UI:N): No victim action is required.
• Scope (S:U): The impact is confined to the vulnerable component's security authority.
• Confidentiality (C:H): High impact—attackers can read sensitive files, including credentials and configuration.
• Integrity (I:H): High impact—attackers can modify files or execute code, altering system behavior.
• Availability (A:H): High impact—attackers can disrupt services or delete critical files.

The blast radius includes any web server hosting the vulnerable Werkstatt theme. Given that it is a WordPress theme, affected systems are likely part of a broader WordPress installation, which may host multiple sites or share resources. The lack of a patch (0/4 patch confidence) means all deployments are at risk until a fix is released or mitigations are applied. The EPSS score is not yet available, but the absence of public exploits suggests a lower immediate exploitation likelihood; however, the severity remains high due to potential impact.

Detection Guidance

Sigma Rule

title: PHP Local File Inclusion Attempt in Fuelthemes Werkstatt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-94062 via directory traversal or file inclusion patterns in HTTP requests.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - 'php://filter'
      - 'php://input'
      - 'data://'
      - 'expect://'
  condition: selection
falsepositives:
  - Legitimate use of relative paths in application logic
  - Security scanners
level: high
tags:
  - attack.t1190
  - cve.2026.94062

YARA Rule

rule CVE_2026_94062_Werkstatt_LFI
{
    meta:
        description = "Detects HTTP requests attempting local file inclusion against Fuelthemes Werkstatt"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-94062"
        severity = "high"
    strings:
        $traversal1 = "../" ascii wide nocase
        $traversal2 = "..%2f" ascii wide nocase
        $traversal3 = "..%5c" ascii wide nocase
        $phpfilter = "php://filter" ascii wide nocase
        $phpinput = "php://input" ascii wide nocase
        $datawrap = "data://" ascii wide nocase
        $expect = "expect://" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94062 Fuelthemes Werkstatt PHP Local File Inclusion Attempt"; flow:to_server,established; content:"../"; http_uri; nocase; sid:202694062; rev:1; reference:cve,2026-94062; classtype:web-application-attack;)

Elastic Detection

sequence by process.entity_id
  [process where event.type == "start" and process.name == "php" and process.args : "include*"]
  [network where destination.port == 80 or destination.port == 443]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=urldecode(uri)
| search uri="*../*" OR uri="*..%2f*" OR uri="*..%5c*" OR uri="*php://filter*" OR uri="*php://input*" OR uri="*data://*" OR uri="*expect://*"
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, uri, status
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="10094062" level="12">
    <if_sid>31100</if_sid>
    <url>\.\./|\.\.%2f|\.\.%5c|php://filter|php://input|data://|expect://</url>
    <description>CVE-2026-94062: Fuelthemes Werkstatt PHP Local File Inclusion attempt detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_94062,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable the vulnerable theme or plugin until a fix is available. If the functionality is essential, consider temporarily removing the vulnerable component.
   • Implement a Web Application Firewall (WAF) with rules to block directory traversal sequences (../, ..%2f, ..%5c) and PHP stream wrappers (php://, data://, expect://) in request parameters.
   • Restrict PHP configuration: set allow_url_include = Off and allow_url_fopen = Off to prevent remote file inclusion. Ensure open_basedir is configured to limit file access to the web root.
   • Apply the principle of least privilege to the web server user to minimize the impact of a successful LFI.

2. Patch/Upgrade Steps:

   • No patch is currently available. Monitor the vendor's official channels (Fuelthemes website, WordPress theme repository) for an updated version. Once released, upgrade Werkstatt to the patched version immediately.
   • If the vendor does not release a fix, consider migrating to an alternative theme or implementing a custom code fix by sanitizing all user inputs passed to include/require statements.

3. Long-term Hardening:

   • Conduct regular security audits and code reviews of all custom and third-party themes/plugins.
   • Implement a vulnerability management program to track CVEs and apply patches promptly.
   • Enforce input validation and output encoding across all web applications.
   • Deploy runtime application self-protection (RASP) or file integrity monitoring to detect unauthorized file inclusions.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-94062
• CWE-98: https://cwe.mitre.org/data/definitions/98.html
• OWASP: Testing for Local File Inclusion - https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
• WordPress Theme Security: https://wordpress.org/themes/werkstatt/ (vendor site)
• CISA KEV: Not applicable (CVE-2026-94062 is not in the KEV catalog as of intelligence cutoff). No known threat actor campaigns or exploit-in-the-wild evidence are available at this time.