Missing authentication in the MAX platform adapter of cc-connect through 1.5.0 allows remote attackers to forge webhook updates and, by supplying an allowed or admin user_id, trigger privileged host commands such as /shell. The flaw only materialises when the MAX adapter is deployed in webhook mode with no webhook_secret configured and its listener on port 8080 is network-reachable; configuring a secret eliminates the exposure entirely. At time of analysis there is no CISA KEV entry, no vendor-released patch version published, and no public exploit identified, though the technical bar to exploitation is low once the misconfiguration is present.
Unauthenticated remote attackers can delete arbitrary files on WordPress/WooCommerce sites running the PPOM - Product Addons & Custom Fields for WooCommerce plugin through version 34.0.10, abusing insufficient path validation in the rename_files function that is reachable via the plugin's cart/order file-handling path. Removing critical files such as wp-config.php can push the site into a re-installation state that is readily leveraged for remote code execution, and because the relocated file is moved byte-identically into the web-accessible wp-content/uploads/ppom_files/confirmed/ directory, the same flaw also exposes arbitrary file read for anything the web server user can read. Wordfence rates it 9.1 and independent assessment confirms CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. no authentication, privileges, or user interaction required against default internet-exposed configurations; no public exploit code has been identified at time of analysis. This is a genuine high-priority issue, not a CVSS-inflated one, with the main precondition being simply that the vulnerable plugin version is installed, active, and serving requests.
Unauthenticated attackers can trigger arbitrary WordPress action hooks on sites running the Avada (Fusion) Builder plugin up to and including 7.16.1, because the plugin dispatches a hook whose name is taken directly from an attacker-supplied form-field value without verifying authorization. The demonstrated impact is permanent destruction of site content - a crafted request deleted trashed posts, pages, and comments via the core wp_scheduled_delete action - with denial of service (e.g. wp_maybe_auto_update) and, where additional vulnerable third-party hook handlers are installed, further privileged writes; a blind arbitrary user/post-meta read also exists but its results are delivered only to the site owner and are not attacker-exfiltrable. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), this is a genuine high-priority issue rather than an inflated score, though it is not confirmed actively exploited and no public exploit code has been identified at time of analysis. The vendor addressed it in Avada 7.16.2.
Unauthenticated privilege escalation in the Blocksy Companion WordPress plugin (versions up to and including 2.1.58) allows remote attackers to register and be automatically logged into a Dokan 'seller' (vendor) account, gaining publishing capabilities beyond those of a normal customer - even on sites where Dokan vendor signup is explicitly disabled. The flaw lies in the plugin's implement_user_registration() AJAX handler, which disables Dokan's vendor-registration nonce check and trusts an attacker-supplied role parameter passed to WooCommerce's customer-creation functions, giving a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N). Exploitation requires the Dokan multivendor plugin and WooCommerce to be active alongside the vulnerable Blocksy Companion, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the T_STD_STRING typemap shipped with ExtUtils-Typemaps-Default before 1.06 causes the generated C++ conversion to evaluate SvCUR($arg) before stringifying the argument, so a derived XS/C++ module that passes a non-string Perl scalar (integer, number, or reference) into the std::string conversion can read an invalid length and abort or segfault the process. The defect is not present in a running service by default but is compiled into derivative XS modules, and it only triggers when the build toolchain's unspecified argument-evaluation order happens to evaluate the length macro first, so exposure is conditional rather than universal. The headline CVSS 9.1 conflicts sharply with the authoritative assessment (AC:H, C:L/A:H) and a very low EPSS of 0.19% (8th percentile); no public exploit code was identified at time of analysis.
Unauthenticated arbitrary file upload in the Tailored Tools plugin for WordPress (versions up to and including 3.0.3) allows remote attackers to write attacker-controlled files to the web server, which can be escalated to remote code execution where the uploaded file type is executable. The vulnerability is rated CVSS 9.0 (assessed vector AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H) and requires no authentication or user interaction, though the high attack-complexity component indicates a non-trivial precondition such as path/filename guessing or a specific plugin configuration that must be satisfied for a successful upload. No public exploit code was identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis; real-world exposure is limited mainly by the plugin's narrow deployment footprint.
Arbitrary file upload in the FV Player 8 WordPress plugin (versions up to and including 8.1.7) allows an authenticated attacker with only subscriber-level access to write attacker-supplied remote file content into the public uploads directory, which can lead to remote code execution if the planted file lands in a web-executable location. The vulnerable path is the new-player-creation flow, which is missing a capability check and invokes check_mimetype(), a function that stores the file before any MIME or extension validation occurs; successfully exploiting this therefore requires winning a race condition between the pre-validation write and the subsequent check, which reduces reliability and may require repeated attempts. Sites that permit open user self-registration effectively expose this to any remote party who can create an account. No public exploit code was identified at time of analysis, and the issue is rated High complexity (AC:H) in our independent assessment versus the vendor vector's AC:L, so exploitation should be treated as feasible but probabilistic rather than trivial.
PHP object injection in the Angio WordPress theme (versions 1.1.1 and earlier) allows authenticated attackers with Subscriber-level access to supply malicious serialized data, potentially achieving remote code execution, file manipulation, or other high-impact outcomes if a usable gadget chain exists in the theme, plugins, or WordPress core. Exploitation requires an authenticated Subscriber account (CVSS vector PR:L), which is often obtainable through open user registration, and no public exploit code or active exploitation has been identified at time of analysis. This is a priority-worthy flaw but not an emergency, as practical impact is contingent on the presence of a gadget chain.
PHP Object Injection in LifterLMS through 10.2.1 requires an authenticated user with the edit_course capability-such as Instructor, Instructor's Assistant, LMS Manager, or Administrator-and is reachable only during lesson creation when a temporary lesson ID enters the custom metadata path in class.llms.admin.builder.php. Although rated high at CVSS 8.8, the plugin contains no POP gadget chain, so exploitation has no impact unless a separate installed plugin or theme provides a usable POP chain; if such a chain exists, an attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on the chain. No public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the Groundhogg CRM, Newsletters, and Marketing Automation WordPress plugin (all versions up to and including 4.9) lets any authenticated user holding the default sales_rep role - which carries edit_contacts, view_notes, and add_notes but not edit_users or promote_users - take over an administrator account. The vulnerable process_edit() handler in the contacts admin page accepts an attacker-supplied 'user' parameter without an ownership or capability check, so a contact can be relinked to an administrator's WordPress user ID; generating a note containing the {auto_login_link} replacement tag then produces a valid permissions-key auto-login URL for that contact, which the attacker reads back through view_notes and visits to authenticate as the administrator. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8), and the flaw requires an existing low-privileged account rather than anonymous access; no public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3) lets an authenticated LatePoint user who holds the settings__edit capability overwrite the default_wp_role_for_customer setting with 'administrator', so that any LatePoint customer account self-registered afterwards is created with full WordPress administrator rights. The flaw is entirely server-side - the role restriction exists only in the UI dropdown and is never validated when the setting is persisted - but it is gated by two real prerequisites: a WordPress administrator must first delegate settings__edit to an agent or custom role, and a new customer registration must occur after the malicious value is saved for the escalation to materialize. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this as a genuine high-impact issue that nonetheless sits below its 8.8 headline score in practical priority.
Authenticated privilege escalation in the FooSales - Point of Sale (POS) for WooCommerce plugin for WordPress (all versions up to and including 1.43.0) allows any account with FooSales Cashier-level access or above to overwrite arbitrary users' email addresses - including an administrator's - and then abuse WordPress's standard password-reset workflow to take over those accounts. The flaw is a missing identity/ownership check (CWE-269) in the plugin's user-details update path, rated CVSS 8.8 with PR:L (authenticated, low privilege) and no user interaction required; the only real barrier is obtaining a Cashier-or-higher role, after which full site compromise is achievable provided email-based password reset is enabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the available data, but the low prerequisite privilege and high confidentiality/integrity/availability impact make this a genuinely high-priority flaw for any site running the affected plugin. Patch status per available data: upstream fix available (changeset/commit); released patched version not independently confirmed.
Authenticated attackers can exploit a PHP Object Injection flaw (CWE-502) in the WordPress plugin Slider by 10Web (slider-wd) versions up to 1.2.62, potentially achieving remote code execution, file manipulation, or data tampering if a suitable POP gadget chain is present. The vulnerability requires low-privilege authentication (CVSS PR:L) and network access with no user interaction, but its real-world impact is contingent on the availability of a gadget chain in WordPress core or other installed components. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting (XSS) in the LTL Freight Quotes WordPress plugin before 4.2.19 enables unauthenticated attackers to inject malicious JavaScript that executes in an administrator's browser session when the admin views the affected administrative page. The flaw arises because values submitted through an unauthenticated endpoint are neither sanitized nor escaped before being stored and later rendered. Although the vendor-assigned CVSS score is 8.8, our independent assessment classifies this as a scope-changing XSS with limited confidentiality and integrity impact (C:L/I:L/A:N) and requiring administrator interaction (UI:R). No public exploit code or active exploitation has been identified, and the vendor has released a patched version (4.2.19).
Incorrect authorization in iflytek SkillHub before 0.2.22 allows account takeover via the self-service account-merge flow: the merge-initiate endpoint returned the verification token directly to the caller and the verify/confirm steps never required the target account to approve from its own authenticated session, so a single low-privilege authenticated user who knows a victim's username or OAuth identity can complete a merge and inherit that victim's API tokens, roles and namespace ownership. Exploitation requires only a valid SkillHub session (PR:L per the CVSS vector - no administrative rights) and works against default deployments because the API enforces the flow even though the /settings/accounts UI remains redirected. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the attack is low-complexity and high-impact, warranting prompt patching; the vendor-released fix is SkillHub 0.2.22.
Unauthenticated SQL injection in the LTL Freight Quotes WordPress plugin (versions 4.2.11 up to but not including 4.2.19) lets remote attackers inject arbitrary SQL through an unsanitised request parameter, giving high-impact read access to the underlying WordPress database - including user credential hashes and any customer or quote data the site stores. Exploitation requires no authentication, no user interaction, and no special configuration beyond an active, network-reachable vulnerable install, and a vendor patch is available in 4.2.19. No public exploit code has been identified at time of analysis, and the practical risk is tempered by the narrow installed base of this specialised less-than-truckload freight-quoting plugin, though sites that have not yet updated remain fully exposed.
SQL injection in the Qode Tours WordPress plugin (all versions up to and including 3.1.3.2) allows a low-privileged authenticated user holding only the Subscriber role to inject arbitrary SQL through plugin-supplied input, exposing sensitive records such as WordPress user credentials and site configuration. Exploitation is remote, low-complexity and needs no user interaction, but it does require a valid account, so sites that allow open self-service registration effectively hand attackers the prerequisite while sites with registration disabled sharply reduce exposure. A published CVSS base of 8.5 reflects a scope-changed vector with confidentiality and availability impact, whereas independent assessment scores the same flaw more conservatively with unchanged scope and confidentiality-only impact; no public exploit code is identified at time of analysis and the issue is not listed in CISA KEV, though the low privilege bar makes it attractive for automated mass scanning.
Authenticated SQL injection in the WordPress plugin Events Manager, affecting versions through 7.4.6, allows a Subscriber-level user - the lowest registered role on a WordPress site - to inject arbitrary SQL into plugin queries, yielding an assessed CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) with high confidentiality impact, low availability impact, and no integrity impact. No end-user interaction is required and the flaw is network-reachable, but the PR:L prerequisite means an outside attacker must first obtain a Subscriber account, which in practice depends on the target site permitting open user self-registration; sites that disable registration substantially raise the barrier to exploitation. No public exploit identified at time of analysis, and the issue was reported through Patchstack - the combination of scope-changed database read impact and a low-privilege foothold makes this a credible, actionable priority rather than an inflated high-CVSS score.
SQL injection in the WordPress plugin Barcode Scanner with Inventory & Order Manager (versions up to and including 1.13.1) lets an attacker who holds a Subscriber-level account inject arbitrary SQL through plugin input, as reported by Patchstack via CVE-2026-62117. The vulnerability is network-reachable, low-complexity and needs no user interaction, and because Subscriber is the lowest standard WordPress role, any site that allows open self-registration effectively exposes the flaw to any visitor who signs up. Patchstack scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), while our independent assessment uses CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N (base 7.1), reflecting high confidentiality impact and limited integrity impact without a scope change; no public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in CellHubs 'ExifTool for photo and video' 5.0.1-gms allows code execution within the app's own sandbox when a media file whose path or filename contains an embedded single quote and shell metacharacters is selected and exported to CSV. The app builds a shell string and passes it to /system/bin/sh -c, wrapping the media path in single quotes without escaping embedded single quotes, so the quoting can be broken out of and the remaining characters interpreted as shell commands. Exploitation is local and requires user interaction: the malicious file must already reside on the device and the victim must manually select it and trigger CSV export; the vulnerability received an assessed CVSS:3.1 score of 8.4 (equivalent 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Authentication requirements are unauthenticated per the CVSS vector (PR:N), meaning no prior privilege on the device is needed for an attacker who can plant the crafted file.
Privilege escalation in the WPMU DEV Forminator WordPress plugin affects every release through 1.57.3 and lets an attacker abuse incorrect privilege assignment logic to obtain capabilities beyond those granted to their account, resulting in high integrity impact and some availability impact. Our independent assessment scores the issue using the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, i.e. network-reachable, low complexity and no user interaction, but with PR:L rather than the vendor-reported PR:N, meaning a low-privileged account is the more likely precondition and any site offering low-privilege registration should treat this as high priority. There is confirmed actively exploited? No - no KEV listing, and no public exploit identified at time of analysis, so this should be prioritized on the basis of the privilege-escalation class and the wide install base of the plugin rather than on observed attacks.
Local file inclusion in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.187) allows unauthenticated remote attackers to pass a crafted 'design_type' parameter through the plugin's tags-widget AJAX path and force the server to include attacker-chosen .php files, which the plugin's own geodir_basic_nonce does not meaningfully impede because that nonce is localized into the geodir_params script object on every public frontend page. The immediately attainable impact is access-control bypass and disclosure of sensitive server-side data, while full arbitrary PHP code execution is conditional on an attacker-controllable .php file already existing on the server or being uploadable to it; the independent assessment rates the vector as AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis. Versions 2.8.188 and later are not affected because design_type is restricted to a fixed allowlist and template names are validated against directory traversal and null bytes.
Replaying a previously-issued OIDC id_token allows unauthenticated attackers to bypass authentication in WPO365 Login (≤44.1) and take over any WordPress account, including administrators. The flaw is gated by the non-default use_id_token_parser_v2 option and requires a valid id_token for the target account. No public exploit code has been identified at time of analysis.
Unauthenticated remote code execution in the Everest Backup WordPress plugin affects all versions through 2.3.13, allowing a network-reachable attacker to inject and execute attacker-controlled code without logging in and without any victim interaction (CVSS 3.1 base 8.1, vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, rooted in CWE-94 code injection). The High attack-complexity rating is the key tempering factor: exploitation hinges on a condition the attacker does not fully control - such as a specific plugin state, timing window, or particular configuration/data value reaching the injection sink - so reachability must be validated per site rather than assumed, and no public exploit code was identified and no CISA KEV listing exists at time of analysis. Sites running the plugin at 2.3.13 or earlier and exposing the vulnerable endpoint to the internet should treat this as high priority; sites that have deactivated or removed the plugin, or that gate the endpoint behind network controls, are not exposed.
Unauthenticated password change against arbitrary WordPress accounts - including Administrator accounts - is possible through the Advanced Form Integration - Connect Forms to 300+ Apps plugin for WordPress in all versions up to and including 2.9.0, letting an attacker submit a public Contact Form 7 form carrying a victim's email address, the field key user_pass, and an attacker-chosen password value. The adfoin_ultimatememberac_send_data handler resolves the target user from the attacker-supplied email and forwards the attacker-controlled key/value pair directly to UM()->user()->update_profile() in the 'account' context, which deliberately bypasses Ultimate Member's banned-key validation and performs no sender identity verification, ownership check, capability check, current-password reauthentication, or sensitive-key restriction (CWE-287). The decisive gate is configuration, not attacker skill: an administrator must already have mapped public form inputs to the Ultimate Member 'Update Profile Field' action, which is why the assessed vector carries AC:H despite PR:N; no public exploit code has been identified at time of analysis.
Broken access control in the WPSection WordPress plugin through version 1.5.1 allows an authenticated subscriber-level user to perform privileged actions that should be restricted to higher-privileged roles, resulting in high integrity and availability impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The flaw is a missing authorization check (CWE-862): the plugin does not verify that the calling user holds the capability the action demands, so any valid low-privileged account on an affected site - the description explicitly cites the Subscriber role - can trigger the vulnerable code paths without user interaction. Only sites running WPSection 1.5.1 or earlier that allow subscriber-level or comparable self-registration are realistically exposed, since an anonymous visitor cannot reach the functionality; no public exploit identified at time of analysis, and the plugin's narrow deployment base limits mass exploitation.
Privilege escalation in the Groundhogg CRM, Newsletters & Marketing Automation plugin for WordPress (all versions through 4.8.3) lets an attacker-controlled account whose user_login is exactly 'groundhogg' and whose user_email matches one of the hardcoded support addresses be silently promoted to administrator when a legitimate admin invokes the plugin's support-access feature. Exploitation is a deliberate two-actor sequence: the attacker must first plant or self-register the matching account (possible when open registration or any other self-service account-creation path exists), after which an admin triggering the submit_ticket or process_send_support_access entry points causes create_support_user() to adopt and promote that account; on multisite the promotion reaches super admin level when the triggering administrator holds manage_network_options, resulting in full site takeover. No public exploit code and no confirmed actively exploited (CISA KEV) status were identified at time of analysis, and the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R reflects both the low-privileged account the attacker must first obtain and the administrative interaction the flaw depends on.
Unauthenticated local file inclusion in the WordPress Backhoe theme (versions 2.0 and earlier, vendor 'mymoun') lets remote attackers cause a server-side PHP include/require construct to load a file path they influence, exposing sensitive local files such as wp-config.php and disclosed configuration data. The supplied CVSS vector is AV:N/AC:H/PR:N/UI:N, and the independent assessment scores confidentiality only (C:H/I:N/A:N), so the practical impact is information disclosure rather than code execution or data modification, with the high attack-complexity component reflecting an unnamed precondition (the specific vulnerable parameter, endpoint, or environment configuration) that must be derived from the Patchstack advisory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation is limited to sites actually running this low-popularity theme, and sites on a patched release or not using Backhoe are unaffected.
Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated local file inclusion in the Flipmart WordPress theme (versions up to and including 2.8, published by ckthemes) allows remote attackers to force the theme's PHP code to include and disclose files on the underlying server. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment) confirms no authentication (PR:N) and no user interaction (UI:N) are needed, but the high attack-complexity rating indicates exploitation depends on specific request parameters, path-traversal or stream-wrapper encoding, or particular PHP/server configuration rather than succeeding against every deployment. The primary demonstrated impact is confidentiality loss (arbitrary file read); escalation to code execution would require includable attacker-influenced content such as logs or uploads and is not established by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch has been identified; a Patchstack advisory documents the issue.
Unauthenticated local file inclusion in the CocoBasic Fabius WordPress theme (versions 1.0 and earlier) allows remote attackers to read arbitrary files on the server via crafted requests that reach an include/require statement. The assessed impact is limited to confidentiality (no integrity or availability impact), and the high attack complexity (AC:H) means successful exploitation depends on specific request crafting and server configuration, such as the presence of poisonable files or permissive PHP wrappers. No public exploit code has been identified and the theme's small deployment footprint further reduces risk, making this a moderate-priority issue.
Unauthenticated local file inclusion in the Teoro WordPress theme (CocoBasic) at versions 1.1 and below lets a remote attacker induce the theme's PHP code to include a locally present file - most critically wp-config.php - exposing database credentials and salts that can be reused to take over the site. The vulnerability requires no credentials (PR:N) and no user interaction (UI:N), but the CVSS AC:H metric indicates a meaningful precondition outside the attacker's direct control (for example a specific request/encoding state or environment configuration), and exposure is limited to sites actively running this specific theme at a vulnerable version; there is no CISA KEV listing and no public exploit identified at time of analysis. The published base score is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the assessed vector lowers integrity and availability impact to L, so real-world risk skews toward moderate rather than critical.
Unauthenticated local file inclusion in the CocoBasic Kaven WordPress theme (versions 1.2 and earlier) allows remote attackers to cause the theme to include and output files from the underlying server, exposing sensitive content such as wp-config.php, credential files, and other data outside the web root. The affected population is limited: Kaven is a niche commercial WordPress theme, so exposure is small compared with core WordPress or high-volume plugins, and no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV. Exploitation is not trivial despite the unauthenticated vector - the CVSS AC:H rating and our independent assessment indicate a required non-default precondition or non-deterministic element (for example a specific theme parameter or feature being reachable, knowledge of an absolute file path, or particular PHP configuration such as allow_url_include) that the public advisory does not fully detail.
Unauthenticated local file inclusion in the Volos WordPress theme (versions 1.2 and below, published by CocoBasic) allows remote attackers to influence a PHP include/require path and pull in arbitrary local files on any site running the affected theme. The vulnerability is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but the high attack complexity score indicates a non-trivial precondition - a specific configuration, path, or environmental state - must be satisfied for reliable exploitation, and the affected installed base is limited to sites actively running Volos. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation is expected to be opportunistic rather than mass-campaign driven.
Unauthenticated local file inclusion in CocoBasic's Cardea WordPress theme (version 2.3 and earlier) lets remote attackers feed attacker-influenced input into a PHP include/require path, exposing arbitrary local files and - per the assessed vector's high integrity impact - potentially enabling code execution or file tampering if the right secondary conditions are met. The flaw needs neither authentication (PR:N) nor user interaction (UI:N), but the high attack complexity (AC:H) indicates a non-trivial precondition or configuration-dependent circumstance that the single Patchstack advisory does not spell out, so reliable exploitation against every default install is not guaranteed. Exploitation is bounded by the requirement that the Cardea theme be installed and active, there is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, making this a moderate-priority issue rather than an emergency.
Unauthenticated local file inclusion in the Mikado Themes 'TouchUp' WordPress theme (all versions below 1.4) lets remote attackers reach a PHP file-inclusion routine without any credentials or user interaction, exposing arbitrary files on the web server. Our assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact with high attack complexity, meaning successful exploitation depends on specific request conditions, path constraints or server configuration and is not guaranteed against every default install. Impact is confined to self-hosted WordPress sites running this specific theme, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is TouchUp 1.4.
Local file inclusion in KuteThemes DukaMarket WordPress theme through version 1.3.0 allows a remote unauthenticated attacker to read arbitrary local files on an affected web server, though the independent assessment limits impact to confidentiality only (C:H/I:N/A:N) rather than integrity or availability. Successful exploitation is constrained by high attack complexity (AC:H), typically requiring a specific traversal or filter-bypass condition, and real-world exposure is limited to WordPress sites running this theme. No CISA KEV entry is present, no public exploit identified at time of analysis, and no EPSS score is supplied; the submitted CVSS 8.1 appears to reflect high integrity/availability impact that the independent assessment does not confirm.
Unauthenticated local file inclusion in the Uminex WordPress theme from Kutethemes affects every release up to and including 1.0.9, allowing a remote attacker who can reach an affected installation to supply crafted input to a PHP file-inclusion code path and read files from the underlying server. Patchstack published the issue at CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment narrows the realistic outcome to disclosure of local files only (C:H/I:N/A:N) with a lower attack complexity, so integrity and availability impact should not be assumed without a demonstrated exploit. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the intelligence; the signals are mixed and point to moderate rather than emergency priority.
Unauthenticated local file inclusion in the Aalto WordPress theme (vendor Edge Themes) at versions 1.8 and earlier allows remote attackers to steer the theme's PHP include/require logic toward attacker-influenced file paths, producing the high confidentiality, integrity, and availability impact reflected in the assessed CVSS of 8.1. The vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so no authentication or user interaction is required but a non-default precondition - such as a specific request parameter, a reachable theme code path, or includable content the attacker can reference - must be satisfied for exploitation to succeed, which is why the issue is context-dependent rather than universally exploitable. Exposure is limited to sites actively running the Aalto theme at 1.8 or below; there is no public exploit identified at time of analysis and the theme is not confirmed actively exploited (no CISA KEV listing).
Unauthenticated local file inclusion (LFI) in the CleanSkin WordPress theme versions 1.5.0 and earlier allows remote attackers to include and potentially execute arbitrary local files, leading to information disclosure or, under specific conditions, code execution. The CVSS score is 8.1 (High), but exploitation requires high attack complexity (AC:H) and the exact vulnerable parameter or endpoint is not disclosed, so the practical risk is tempered. No public exploit code exists at time of analysis, and the Patchstack advisory does not specify a fixed version.
Local file inclusion in the Kids Care WordPress theme through version 3.2.4 allows unauthenticated remote attackers to manipulate a file-inclusion parameter and read local server files, with wp-config.php and other readable files as the primary exposure. The base CVSS vector is 8.1 with High Attack Complexity, but the independent assessment keeps the same unauthenticated and no-user-interaction prerequisites while bounding realistic impact to confidentiality-heavy local file disclosure with Low integrity and availability impact unless log poisoning or PHP wrappers enable escalation. No CISA KEV activity is identified in the provided data, and no public exploit identified at time of analysis; the independent assessment rates this as a credible but not top-tier priority.
Broken access control in the Wordable WordPress plugin (versions up to and including 8.2.10) lets any authenticated Subscriber-level account invoke functionality that should be reserved for higher-privileged roles, yielding high confidentiality and integrity impact (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Reported by Patchstack and rooted in a missing-authorization condition (CWE-862), the issue requires the attacker to already hold or be able to register a low-privilege account, so real-world risk is much greater on sites permitting open user self-registration than on sites where account creation is locked down. No public exploit code was identified at the time of analysis, the CVE is not listed in CISA KEV, and no EPSS data was supplied; treated as a genuine priority-tier vulnerability with a meaningful authentication caveat, it warrants prompt review of plugin exposure and user-registration settings.
Unauthenticated local file inclusion in the Ambient WordPress theme (Elated Themes) at version 1.7 and earlier lets remote attackers coerce the PHP template loader into reading files outside the intended theme path, exposing secrets such as wp-config.php, database credentials, and other server-side data that is echoed back in the response. The vendor vector (AV:N/AC:H/PR:N/UI:N, score 8.1) requires no authentication or user interaction, but the HIGH attack complexity signals a precondition outside the attacker's control must line up for exploitation, so this is not a trivial one-request compromise of every site; our reassessment retains the confidentiality impact while dropping the unconfirmed integrity and availability components. Exposure is limited to WordPress installations running Ambient at 1.7 or below, and no public exploit code has been identified at time of analysis.
Unauthenticated local file inclusion in the KuteShop WordPress theme through version 4.2.9 allows remote attackers to read files from the hosting server - and, given the CWE-98 root cause, potentially to influence which PHP file is included - without any login or victim interaction. The issue is rated CVSS 3.1 8.1 (High) with a network vector (AV:N), no privileges (PR:N) and no user interaction (UI:N), but high attack complexity (AC:H), which indicates exploitation depends on a specific request format, parameter, or theme configuration rather than a trivial default-configuration request. Impact is high across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and reports come from Patchstack, so exposure is limited to sites running this commercial theme with an affected version installed and active.
Unauthenticated local file inclusion in the Boutique WordPress theme from KuteThemes (CPE cpe:2.3:a:kutethemes:boutique) through version 2.3.3 allows a remote attacker to influence a PHP include/require path and read arbitrary local files from the web server without any login or victim interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1, CWE-98). The high attack complexity signals that exploitation is not a simple one-shot request: the attacker must craft a path that survives the theme's filtering and the target's PHP configuration (notably wrapper and allow_url_include settings) before confidentiality, integrity and availability impact materializes at the rated level. There is no public exploit code identified at time of analysis and no CISA KEV listing; the impact beyond local file disclosure - including any escalation to code execution implied by the I:H/A:H sub-scores - is conditional and not confirmed by the description. The only advisory data available is the Patchstack disclosure for the KuteThemes Boutique theme.
Unauthenticated local file inclusion in the KuteThemes Biolife WordPress theme through version 3.2.3 allows remote attackers to steer a PHP include/require path and read arbitrary files from the hosting server, exposing wp-config.php database credentials, API keys, and other sensitive content. The reported vector scores 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but independent assessment narrows realistic impact to confidentiality loss (C:H/I:N/A:N): the attack is unauthenticated and remote, yet high-complexity because the exact vulnerable parameter, encoding, and configuration prerequisites are not documented, so a single guaranteed payload is not established. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exposure is limited to the niche set of sites running this commercial theme at or below 3.2.3.
Unauthenticated local file inclusion in the TechOne WordPress theme (versions 3.0.3 and earlier) allows remote attackers to read arbitrary files from the server by supplying crafted input to a vulnerable PHP include/require statement. No public exploit code has been identified at time of analysis, and the vendor has not released a patched version. While the reported CVSS base score is 8.1, the independent assessment limits the impact to confidentiality (C:H) with high attack complexity (AC:H) and no confirmed escalation to code execution, so real-world priority is moderate despite the high score.
Local file inclusion in the Armania WordPress theme (versions up to and including 1.4.8) allows unauthenticated remote attackers to read arbitrary files on the underlying server, potentially exposing sensitive data such as wp-config.php. The vulnerability stems from improper handling of user-supplied input passed to a PHP include/require statement (CWE-98). No public exploit code or active exploitation has been reported at time of analysis; the vendor rates it 8.1 with high attack complexity, while our assessment confirms network reachability with no authentication or user interaction but notes a non-trivial precondition is required for reliable exploitation.
Authorization bypass in the JoomUnited WP File Download plugin for WordPress (all versions up to and including 6.3.9) allows any authenticated user with subscriber-level access or above to permanently delete any file managed by the plugin, empty the entire trash, move files between categories, and publish or unpublish arbitrary files. The flaw is a missing authorization check (CWE-862), meaning the plugin's action handlers never verify that the caller holds a capability appropriate for the requested operation, so the lowest-privilege WordPress role is sufficient. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, but the barrier to exploitation is low because subscriber accounts are frequently obtainable through open self-registration; the assessed CVSS 3.1 base score is 8.1 (High) with high integrity and availability impact and no confidentiality impact.
Account takeover in the SMS Alert WordPress plugin before 4.0.1 lets unauthenticated remote attackers set a new password on an arbitrary account - including an administrator - by completing the plugin's OTP password-reset flow with a phone number they control. Rated 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw requires no authentication and no victim interaction, but is only reachable where the plugin's SMS/OTP password-reset feature is enabled and the attacker knows or can guess a valid target account identifier, which is why attack complexity is assessed as high. No public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available in version 4.0.1.