Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 allow anyone who can reach the database port to authenticate with full read/write access to the backend datastore. Publicly available exploit code exists, though EPSS remains low (0.81%) and the vendor states the database port is not network-exposed by default in 1.0.1 and later, limiting realistic reach. There is no public exploit identified as actively used in the wild (not in CISA KEV).
Remote denial-of-service in the omec-project UPF (pfcpiface component, version upf-epc-pfcpiface 2.1.3-dev) lets any endpoint able to reach the N4/PFCP interface crash the user-plane function by sending a malformed PFCP Session Establishment Request. The request carries a CreateFAR IE with an empty or truncated IPv4 address; parseFAR() passes it to ip2int(), which reads past the buffer and triggers a Go index-out-of-range panic (CWE-125). Publicly available exploit references exist via the upstream issue tracker, though EPSS remains low (0.46%) and it is not on CISA KEV.
Remote code execution in TinaCMS affects versions prior to 3.1.1, @tinacms/cli before 2.0.4, and @tinacms/graphql before 2.0.3. Authenticated attackers with content control over markdown files can execute arbitrary code through insecure gray-matter package usage. The vulnerability requires low-privilege authentication (PR:L) and user interaction (UI:P), enabling full compromise of confidentiality, integrity, and availability in the vulnerable context. Publicly available exploit code exists, significantly increasing deployment risk for unpatched installations managing user-contributed markdown content.
Unrestricted file upload in WordPress Contact Form 7 PDF plugin through 3.0.0 allows authenticated attackers to upload malicious files, achieving remote code execution with full server compromise (CVSS 9.9). No active exploitation confirmed by CISA KEV, and EPSS indicates low exploitation probability (0.08%).
Authentication bypass in AmentoTech Tuturn plugin for WordPress versions before 3.6 allows remote, unauthenticated attackers to abuse authentication mechanisms and gain privileged access to plugin functionality and potentially the entire WordPress site. No public exploit or active exploitation is identified at this time, and the likelihood of exploitation is rated low according to EPSS (0.12%).
Remote code execution in Mozilla Firefox via use-after-free in Disability Access APIs allows unauthenticated network attackers to compromise browser integrity with high impact. The vulnerability (CWE-416) affects Firefox versions prior to 146.0.1 and requires no user interaction or special privileges. With CVSS 9.8 (Critical) but low EPSS (0.07%, 21st percentile), real-world exploitation probability remains limited despite theoretical severity. No public exploit identified at time of analysis, and vendor-released patch 146.0.1 available.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to query, modify, or delete database records via the cmbAreaCode parameter in /admin/add_retailer.php. Public exploit code is available, but the vulnerability is not known to be actively exploited (CISA KEV). The EPSS exploitation probability is very low (0.05%), indicating limited real-world targeting.
Unauthenticated SQL injection in the WordPress tPlayer plugin (HTML5 audio player with playlist) versions up to 1.2.1.6 allows remote attackers to extract sensitive data from the database via crafted requests, with limited availability impact. The vulnerability has a CVSS score of 9.3, requires no user interaction, and is classified as CWE-89. At the time of analysis, no public exploit code or active exploitation is known, and EPSS probability is low (0.06%).
SQL injection in the Advance Seat Reservation Management for WooCommerce plugin <=3.1 allows unauthenticated attackers to extract sensitive database contents. The vulnerability carries a CVSS 9.3 score, with network vector, no privileges, and scope change leading to high confidentiality impact and minor availability disruption. No active exploitation or public POC has been confirmed, and EPSS indicates a very low exploitation probability (0.05%).
Remote code execution in Hotel Booking Lite (motopress-hotel-booking-lite) for WordPress allows authenticated attackers with high privileges to inject and execute arbitrary code on the server via remote file inclusion. The flaw affects versions up to and including 5.2.3. No active exploitation or public proof-of-concept is reported, but the high CVSS score highlights severe impact if exploited by a compromised admin account.
Remote unauthenticated arbitrary file upload with path traversal in WP Webhooks plugin up to version 3.3.8 allows full site compromise. Attackers can upload malicious files to arbitrary directories, leading to code execution and data theft. No user interaction required, but exploitation is of high complexity.
Privilege escalation in e-plugins Hotel Listing plugin for WordPress (≤1.4.0) allows authenticated low-privileged attackers to gain administrator access. Successful exploitation could lead to full site compromise. No public exploit code or active exploitation has been confirmed; EPSS indicates low exploitation probability (0.08%).
Object injection via unsafe deserialization in PDF Invoice Builder for WooCommerce plugin allows authenticated attackers with low privileges to execute arbitrary PHP code, manipulate application objects, or trigger other malicious actions. Affects all versions through 6.5.0. No public exploit identified at time of analysis, with EPSS probability of 0.07% suggesting minimal real-world exploitation activity despite high CVSS score.
Object injection via unsafe deserialization in PDF for WPForms plugin (versions ≤6.5.0) enables authenticated attackers to execute arbitrary PHP code or manipulate application state. The CVSS score of 8.8 reflects network-based exploitation with low complexity requiring only low-privileged authentication. EPSS probability of 0.07% (22nd percentile) suggests limited exploitation likelihood. No public exploit code or CISA KEV listing identified at time of analysis, indicating this remains a theoretical risk requiring proactive patching.
Object injection via unsafe deserialization in PDF for Contact Form 7 WordPress plugin (versions ≤6.5.0) allows authenticated attackers to execute arbitrary PHP code or manipulate application state. Attack requires low-privileged user credentials but no user interaction, with network-accessible attack vector. EPSS probability remains low (0.07%, 22nd percentile) and no active exploitation confirmed at time of analysis. Publicly available exploit code exists per Patchstack disclosure.
PHP object injection in PDF for Elementor Forms plugin through version 6.5.0 allows authenticated attackers to execute arbitrary code or manipulate application logic via deserialization of untrusted data. While CVSS scores this 8.8 (High), real-world risk is tempered by authentication requirement (PR:L) and low EPSS score (0.06%, 19th percentile), indicating minimal observed exploitation attempts. No CISA KEV listing or public exploit code identified, suggesting attacks remain theoretical rather than widespread.
Memory corruption in Mozilla Firefox 146 enables remote code execution when users interact with malicious web content. Multiple memory safety bugs with exploitable potential affect Firefox 146 on all platforms. The vendor released Firefox 146.0.1 to address these issues. EPSS exploitation probability is low (0.06%, 18th percentile), and no public exploit identified at time of analysis, though Mozilla's security team assessed some bugs as likely exploitable with sufficient development effort.
Arbitrary file write in Streama (open-source self-hosted media server) versions 1.10.0 through 1.10.5 lets an authenticated user chain a path traversal flaw with a server-side request forgery in the subtitle download feature to plant files anywhere the application process can write, potentially escalating to remote code execution. The subtitle endpoint trusts both the remote fetch URL and the destination filename, so a crafted download link plus a '../' filename escapes the intended staging directory. There is no CISA KEV listing and no packaged exploit is flagged in the source data, though a detailed VulnCheck advisory and a public technical write-up (chocapikk.com) describe the mechanics.
Blind SQL injection in the Traveler WordPress theme by shinetheme affects versions below 3.2.6, allowing authenticated low-privilege attackers to extract sensitive database information. No public exploit code or active exploitation has been identified at time of analysis, and EPSS indicates a low exploitation probability (0.05%).
Blind SQL injection in the PopupKit WordPress plugin through version 2.1.5 allows authenticated attackers with low privileges to extract sensitive database information without user interaction. The vulnerability, assigned CWE-89, has a high CVSS score but a very low EPSS probability (0.05%), and no known public exploits or active exploitation have been identified at this time.
Local file inclusion in the TieLabs Jannah WordPress theme up to version 7.6.0 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to sensitive information disclosure (e.g., wp-config.php) or remote code execution via log poisoning. The EPSS score of 0.22% indicates a low probability of imminent exploitation, and no public exploit code or active exploitation has been identified at time of analysis.
Local file inclusion in AncoraThemes Fabrica theme for WordPress <=1.8.1 allows unauthenticated attackers to include and read arbitrary local files on the server, leading to information disclosure and, if chained with techniques like log poisoning or file upload, potential remote code execution. No active exploitation or public exploit has been confirmed; EPSS indicates a low exploitation probability (0.22%).
Local File Inclusion (LFI) in BZOTheme Monki WordPress theme versions through 2.0.5 allows unauthenticated remote attackers to include and execute arbitrary PHP files on the server, potentially leading to remote code execution, information disclosure, or complete system compromise. Despite the high 8.1 CVSS score, real-world exploitation probability remains low (EPSS 0.17%, 38th percentile) with no confirmed active exploitation or public exploit code identified at time of analysis. The vulnerability stems from improper filename validation in PHP include/require statements, classified as CWE-98.
Local file inclusion in the Lunna WordPress theme (versions ≤1.15) permits unauthenticated remote attackers to include arbitrary local files, leading to sensitive data exposure and potential remote code execution. The vulnerability carries a CVSS score of 8.1, but exploitation requires high attack complexity and has an EPSS probability of just 0.08%, making widespread automated attack improbable.
Local file inclusion in the Traveler WordPress theme prior to version 3.2.6 allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure, remote code execution, or full site compromise. Exploitation requires a high-complexity attack with no user interaction, and the EPSS exploitation probability is low (0.08%), with no known public exploitation or active attacks at the time of analysis.
Local file inclusion in the Anchor smooth scroll WordPress plugin up to version 1.0.2 allows unauthenticated attackers to read arbitrary files from the server. This can expose sensitive data such as database credentials, and may be escalated to remote code execution under certain server conditions. No active exploitation has been confirmed, and a vendor fix is available.
Local file inclusion in Thememove MinimogWP WordPress theme versions <=3.9.6 allows unauthenticated attackers over the network to include arbitrary local files, potentially leading to sensitive data disclosure and full server compromise. Exploitation has high attack complexity, and while no active exploitation or public exploit is reported, EPSS shows a low probability of widespread attacks.
Local file inclusion in the Giardino WordPress theme (versions ≤1.1.10) allows unauthenticated attackers to read arbitrary files from the server, such as configuration files and source code. Exploitation requires high attack complexity and can lead to full system compromise if code execution is achieved through chaining. No active exploitation or public exploit has been identified, and the EPSS score is very low (0.08%).
Local file inclusion in axiomthemes Katelyn WordPress theme versions through 1.0.10 allows unauthenticated remote attackers to read arbitrary local files, potentially exposing sensitive data or leading to code execution. Exploitation does not require authentication but has high attack complexity, and no public exploit or active exploitation has been identified.
PHP Local File Inclusion in the Pinevale WordPress theme (<=1.0.14) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to remote code execution under high-complexity conditions. No active exploitation or public exploit has been identified, but the vulnerability carries a CVSS 8.1 score and affects all prior versions.
Local file inclusion in axiomthemes Renewal WordPress theme versions ≤1.2.2 allows unauthenticated attackers to read arbitrary local files by manipulating input to a PHP include/require statement. Successful exploitation could expose sensitive data such as wp-config.php credentials, with potential limited code execution via log poisoning. EPSS indicates very low exploitation probability (0.08%), and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Rosalinda WordPress theme ≤1.2.3 permits unauthenticated attackers to arbitrarily include local files, leading to information disclosure and potential remote code execution. The vulnerability is rated high severity (CVSS 8.1) but has low exploitation likelihood (EPSS 0.08%), and there is no evidence of active exploitation or public exploit code at this time.
Unauthenticated remote attackers can exploit a PHP local file inclusion vulnerability in the OnLeash WordPress theme (versions ≤1.5.2) to read sensitive files or achieve remote code execution. No active exploitation or public exploit code has been identified as of this analysis.
Local file inclusion in the MaxCube WordPress theme (versions <= 1.3.1) enables unauthenticated attackers to include arbitrary local files via crafted requests, potentially exposing sensitive data, executing code, and modifying system files. The vulnerability stems from improper validation of filenames in PHP include/require statements. At the time of analysis, no active exploitation or public exploit code is known.
Local file inclusion in AncoraThemes W&D wd theme for WordPress allows unauthenticated attackers to read arbitrary local files and potentially achieve remote code execution. The vulnerability affects versions through 1.0 and has a CVSS 3.1 base score of 8.1, but EPSS predicts a very low exploitation probability (0.08%) with no known public exploits or active exploitation.
We need to produce a JSON object with the specified fields. Input data: CVE-2025-60051, description, CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-98 (PHP Remote File Inclusion), EPSS 0.08% (23% percentile), Reported by: audit@patchstack.com, Tags: Information Disclosure, PHP, LFI. One reference: Patchstack link. The description states: "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Rare Radio rareradio allows PHP Local File Inclusion.This issue affects Rare Radio: from n/a through <= 1.0.15.1." But it says "PHP Remote File Inclusion" but then "allows PHP Local File Inclusion". Conflicting. CWE-98 is "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')". So it's a file inclusion that is incorrectly categorized. Actually, many LFI vulnerabilities are incorrectly labeled as RFI because the code allows inclusion of remote files if allow_url_include is enabled, but if the input is filtered poorly, it might be local only. The description explicitly says "allows PHP Local File Inclusion". So it's LFI, not RFI. We'll note that. No KEV, no patch info beyond the reference to patchstack. So likely a patched version exists but not provided. Patchstack typically lists version and fix. The reference URL might contain details: "https://patchstack.com/database/Wordpress/Theme/rareradio/vulnerability/wordpress-rare-radio-theme-1-0-15-1-local-file-inclusion-vulnerability?_s_id=cve". So it's a Wordpress theme vulnerability. So product: "Rare Radio" Wordpress theme by AncoraThemes. Affected versions: up to and including 1.0.15.1. Need exact product name: "Rare Radio" (theme). product_name: "Rare Radio". That's 1-3 words. Summary: Need original synthesis. Start with impact verb and product. E.g., "Local File Inclusion in Rare Radio WordPress theme up to 1.0.15.1 allows unauthenticated attackers to include arbitrary local files, l
Unauthenticated Local File Inclusion in the Panda WordPress theme up to version 1.21 allows remote attackers to read arbitrary server files and potentially escalate to code execution. The vulnerability is not known to be actively exploited and has an EPSS score of 0.08%, indicating low real-world exploitation probability at this time.
Local file inclusion in the Soleil WordPress theme (versions through 1.17) allows unauthenticated attackers to include arbitrary local files via a network request, potentially exposing sensitive data or enabling remote code execution. Exploitation requires high attack complexity, and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Tripster WordPress theme (versions <= 1.0.10) allows unauthenticated attackers to read and execute arbitrary files on the server, potentially
Local file inclusion in the Ipharm WordPress theme (versions up to 1.2.3) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution. No public exploit or active exploitation is known, and EPSS probability is very low (0.08%), though the CVSS score of 8.1 indicates high potential impact.
Local file inclusion in the AxiomThemes HeartStar WordPress theme permits unauthenticated attackers to include arbitrary local files, potentially leading to remote code execution or full site compromise. The vulnerability affects versions up to and including 1.0.14. While there is no confirmed active exploitation or public exploit code, the EPSS score of 0.08% suggests a very low exploitation probability.
We are tasked with synthesizing data about CVE-2025-60044 into a comprehensive analysis. The input includes: CVE ID, description, CVSS 8.1 with vector, CWE-98, EPSS 0.08%, tags, and a reference to Patchstack. No KEV data, no patch details in the input beyond the description saying "through <= 1.1.0". The description says "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability ... allows PHP Local File Inclusion. This issue affects Fribbo: from n/a through <= 1.1.0." Note: The title says Remote File Inclusion but description says Local File Inclusion. Possibly a misclassification? CWE-98 is "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", which often leads to remote file inclusion if the inclusion is not properly controlled. But the description says PHP Local File Inclusion. We'll handle this. We must output a JSON object with all fields. Let's interpret each: - product_name: "Fribbo" is a WordPress theme. So "Fribbo Theme" or just "Fribbo". Use "Fribbo Theme" maybe. - summary: Original synthesis, not copying description. Start with impact. Impact is local file inclusion (LFI), potentially leading to confidential data exposure, code execution if files are writable, etc. So: "Local file inclusion in the Fribbo WordPress theme (versions <= 1.1.0) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data or enabling remote code execution if coupled with file upload capabilities." Add that EPSS low, no known exploit, not KEV. - technical_context: PHP Include/Require, CWE-98, improper control of filename. WordPress theme, likely uses include() or require() with user-controllable input without proper sanitization. CPE data not provided explicitly, but we can infer from description: "from n/a through <= 1.1.0". So product is "Fribbo" (WordPress theme). Underlying technology: PHP, WordPress themes. CWE-98 refers to PHP Remote File Inclusion but this is LFI; the vulnerability class is file inclusion. Could be RFI if php:// wrappers are disabled or limited. Discuss the root cause. - risk_assessment: CVSS 8.1, AV:N, AC:H, PR:N, UI:N, S:U, C:H/I:H/A:H. AC:H suggests high attack complexity, perhaps due to specific conditions. EPSS 0.08% (low), no KEV, no POC mentioned. SSVC: not given, but we can reason: exploitation status: no known exploit, automatable? AC:H suggests not easily automatable. Technical impact: high (C/I/A all H). So real-world risk may be lower than CVSS suggests because of complexity and low EPSS. Could be a high CVSS but low real risk because product is not widely deployed? Unknown. State that data missing: no patch version specified, no vendor advisory link beyond Patchstack. Patchstack may have provided patch? Not in data. So "patch status unclear; advisory does not mention a fixed version". Also note that CVSS AC:H and no known public exploit. - affected_products: "Fribbo WordPress theme, versions n/a through 1.1.0. Patchstack advisory: [link]." No CPE string given but NVD might have one. - remediation: Not provided. Suggest upgrade to version beyond 1.1.0 if available. As the advisory doesn't specify a fixed version, "contact vendor or monitor Patchstack for update." Workarounds: Disable theme until patch; restrict file access to prevent sensitive file inclusion; disable dangerous PHP functions (allow_url_include) if not needed. But those are generic. Provide actionable. Since no patch, "No official patch available at this time; consider switching to a different theme, or apply web application firewall rules to block file inclusion attempts." - exploit_scenario: An attacker crafts a request to a vulnerable endpoint that includes a local file via directory traversal, e.g., ?file=../../wp-config.php, leading to disclosure of database credentials. - exploitation_conditions: From description, no explicit conditions, but CVSS vector says no user interaction, no privileges, so likely exploitable remotely without authentication. However, AC:H suggests some complexity, maybe the inclusion path is not directly controllable or requires certain PHP configuration. The description: "Improper Control of Filename for Include/Require Statement" means somewhere user input is used to construct a filename for inclusion. So condition: The theme must be active, and the vulnerable parameter must be present, possibly a specific page or AJAX action. So state: "Requires the Fribbo theme (version <= 1.1.0) to be active. Likely exploitable via an HTTP request to a theme component that accepts a filename parameter. No authentication required. High complexity hints at non-trivial exploitation, possibly due to needing to bypass path restrictions or require specific PHP settings (e.g., allow_url_include off)." - attack_chain: Access: Send crafted HTTP request with file path parameter → Exploit: Bypass filename sanitization (if any) → Include local file → Impact: Read sensitive file, achieve code execution via log poisoning or session file inclusion. But we need a chain in kill-chain phases. Let's do: 5-step: Access → Delivery → Exploit → Execution → Impact. Access: Attacker identifies target WordPress site running vulnerable theme. Delivery: Sends HTTP request to vulnerable theme script. Exploit: Parameter containing path traversal triggers file inclusion. Execution: PHP includes arbitrary local file, potentially leading to code execution if php wrappers used. Impact: Disclosure of sensitive data (wp-config.php) or code execution. So chain: "Identify site with Fribbo theme → Send crafted request with malicious file path → Bypass input sanitization to include local file → Execute included code or retrieve file contents → Extract credentials or compromise server." Alternatively, more concise: "Send HTTP request with ‘file’ parameter containing path traversal → Theme includes arbitrary PHP file → Read sensitive file or execute code." - confidence_notes: "Vulnerability reported by Patchstack, but no fixed version listed. Affected version range confirmed by advisory. No CISA KEV or public exploit. CVSS 8.1 indicates high impact but high complexity; EPSS low, suggesting limited real-world threat." I need to be specific: what's confirmed, inferred, unknown. - prevalence: Fribbo is a niche WordPress theme. Likely low prevalence. I'll go with "low". Prevalence_basis: "niche WordPress theme, presumably limited installation base." - assessed_cvss_vector: The existing vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Let's reassess: Attack vector is network (AV:N) as it's a WordPress theme accessible over the internet. Attack complexity high (AC:H) because exploitation might require specific conditions like certain PHP functions not disabled, or the include path must be constructed precisely. Now, what about impact? LFI can lead to reading arbitrary files, so C:H? If you read wp-config.php, yes, confidentiality high. Integrity high? If you can include a log file with PHP code, you could corrupt log files, but that's often not direct integrity impact. However, LFI can lead to RCE, and RCE can mess with system integrity. The CVSS given has C/I/A all High. Could be too aggressive. If only reading files, only C:H. But description says "file inclusion" which might include ability to include any local file, and if combined with file upload, could include a malicious file. But the base vulnerability only allows including local files that already exist, so integrity and availability impacts are less likely unless you can include a file that performs actions. Conservative: C:H, I:L, A:L? But the CVSS from the reporter is 8.1. I might assess slightly lower. Let's set AV:N, AC:H, PR:N, UI:N, S:U. Impact: C:H, I:L, A:L perhaps, but based on typical LFI, it's often confidentiality only unless there is a way to get code execution. If LFI leads to RCE via PHP wrappers (expect://, data://, etc.), that could give full impact. The description says "PHP Local File Inclusion" not Remote, but with wrappers it could be remote code. So the reporter might be assuming worst case. I'll keep assessed vector as close to theirs but justify if any difference. I'll say "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" but note that AC:H due to requirement that vulnerable parameter exists and PHP configuration might restrict wrappers. So assessed_cvss_vector: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H". Rationale: "Network-accessible theme with high complexity; full impact if successful, though integrity and availability depend on included file's content." Actually, we can create our own assessment: I'll use AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L, but they gave 8.1 with all High, so I'll stick with the given but acknowledge. I'll set the assessed vector to same as provided, as it's plausible if RCE possible. I'll note in rationale. - assessed_cvss40_vector: Map to 4.0: AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Scope unchanged, so subsequent all N. AT:N. Precision rules: Exploitation status: neither KEV nor POC, so "no public exploit identified at time of analysis". Patch status: from the description, "through <= 1.1.0" means version 1.1.0 and below are affected. No fix version given, so "Patch available per vendor advisory" (Patchstack advisory might mention fix? The reference URL is Patchstack, but we don't have content. It says "Patch available" in the input? The input does not say patch available. It just gives a vulnerability report. So we cannot confirm patch. Use: "No vendor-released patch identified at time of analysis" but we only have the advisory from Patchstack, which might have a fix? We don't know. So I'll state: "No patch version confirmed; Patchstack advisory may have update details but not provided." In field, I'll write "Vendor patch status unclear; advisory from Patchstack does not specify a fixed version." So in remediation, advise checking Patchstack. Prevalence: "low" and basis: "obscure WordPress theme". Let's craft each field. product_name: "Fribbo Theme" (1-3 words: "Fribbo" alone is enough? I'll use "Fribbo" as product name, but add Theme for clarity: "Fribbo") summary: "Local file inclusion in Fribbo WordPress theme (<=1.1.0) enables unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive data exposure or code execution if combined with file upload or log manipulation. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability." technical_context: "The vulnerability arises from improper validation of user-supplied input used in PHP include/require statements, classified as CWE-98. The Fribbo theme, likely a commercial or niche WordPress product, fails to sanitize filenames passed to inclusion functions, allowing path traversal sequences. CPE data is not available, but the affected version range is from initial release up to 1.1.0. The underlying technology is PHP running on a WordPress site, where includes are server-side and do not require user interaction." risk_assessment: "CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates high impact with complex exploitation. EPSS 0.08% (23rd percentile) suggests very low real-world threat. No CISA KEV or public POC known. The high attack complexity likely stems from the need to bypass any path restrictions or use PHP wrappers that might be disabled. This is a classic high-severity but low-risk scenario for most organizations because of product obscurity and lack of exploits. Missing data: No fix version confirmed; the advisory from Patchstack is the sole source." affected_products: "Fribbo WordPress theme, all versions up to and including 1.1.0. Advisory available at Patchstack (https://patchstack.com/database/Wordpress/Theme/fribbo/vulnerability/wordpress-fribbo-theme-1-1-0-local-file-inclusion-vulnerability?_s_id=cve)." remediation: "No fixed version is listed in the advisory. Users should contact AncoraThemes for a patch or update. As an immediate mitigation, deactivate the Fribbo theme and switch
Local file inclusion in the AncoraThemes Wanderic WordPress theme (versions up to and including 1.0.10) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to full host compromise through information disclosure or remote code execution. Exploitation requires high attack complexity, and no public exploit or confirmed active exploitation has been identified at this time, with EPSS probability at 0.08%.
Local file inclusion in the Chinchilla WordPress theme (version 1.16 and below) allows unauthenticated remote attackers to read arbitrary files on the server, risking information disclosure or remote code execution via log poisoning. The flaw arises from improper filename handling in PHP include/require statements. No public exploit or active exploitation has been identified, and the EPSS percentage remains very low.
Local File Inclusion (LFI) in axiomthemes Lione WordPress theme versions up to 1.16 allows unauthenticated remote attackers to include arbitrary local files via a crafted request. Successful exploitation can lead to sensitive data exposure and, if combined with other attack vectors such as file uploads, remote code execution. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently known; EPSS indicates a low probability of exploitation (0.08%).
Local file inclusion in axiomthemes Spock WordPress theme through version 1.17 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive information. While high complexity limits exploitability, successful exploitation could lead to full system compromise via techniques like log poisoning. No public exploit code or active exploitation has been reported, and EPSS indicates a very low likelihood of real-world attacks.
Local file inclusion in the Aromatica WordPress theme (versions <= 1.8) allows unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive information disclosure or remote code execution if combined with other techniques. The vulnerability is not known to be actively exploited, with a low exploitation probability (EPSS 0.08%).
Local file inclusion in axiomthemes Athos WordPress theme up to version 1.9 allows unauthenticated attackers to include arbitrary local files, potentially achieving remote code execution and full site compromise. Exploitation requires high attack complexity, and while no public exploit or active exploitation is currently known, the impact is critical if successfully leveraged.
Local file inclusion in axiomthemes Vocal WordPress theme versions up to 1.12 allows unauthenticated attackers to read arbitrary files on the server by manipulating file path parameters in PHP include/require statements. No active exploitation or public exploit code has been reported; EPSS score is very low (0.08%), indicating minimal immediate risk.
Local file inclusion in the EcoGrow WordPress theme (up to version 1.7) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data like wp-config.php. While no active exploitation or public exploit code is known, the high CVSS score reflects possible escalation to full server compromise if the PHP environment supports wrapper-based code execution. The low EPSS score (0.08%) suggests very limited exploitation likelihood at this time.