CVE-2026-39677

CVE-2026-39677 is a PHP Remote File Inclusion vulnerability affecting Creatives_Planet Emphires version 3.9 and earlier, caused by improper control of filenames in PHP include/require statements that allows local file inclusion attacks. The vulnerability has a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring low attack complexity and low privileges, potentially enabling attackers to access sensitive data and modify or disrupt system availability. Exploitation requires authentication (PR:L) but no user interaction, making it feasible for authenticated threat actors to leverage this flaw. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild, with an EPSS score of 0.00127 indicating minimal current threat prevalence. Community attention remains low given its inactive status on threat tracking lists, though organizations running affected Emphires versions should prioritize patching to mitigate potential compromise risks.