Skip to content
OpenAdvisories
High · 7.5 CVE-2026-22521 EUVD-2026-1480GHSA-f5vm-3c88-r99x

WordPress Handmade Framework plugin <= 3.9 - Local File Inclusion vulnerability

Published Jan 8, 2026 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in G5Theme Handmade Framework handmade-framework allows PHP Local File Inclusion.This issue affects Handmade Framework: from n/a through <= 3.9.

Affected products

VendorProductAffectedFixed
G5Theme Handmade Framework ≤ 3.9 —

References