Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrator application and obtain tenant-admin ('tenant pack') permissions across any tenant. The SysTenantController passApply handler performs no authorization check, so a low-privilege account can file an application via doApplyTenantPackUser and then approve it with a PUT to /sys/tenant/passApply, reaching high confidentiality and integrity impact without user interaction or elevated privileges (assessed CVSS 3.1 8.1, PR:L). Publicly available exploit code exists - a Python proof-of-concept for tenant ownership and pack approval is published on GitHub and referenced by VulnCheck - but no CISA KEV entry has been reported, so confirmed active exploitation cannot be asserted.
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authenticated user - regardless of privilege level - rewrite department role permissions, granting themselves arbitrary menu and button permissions or stripping permissions from other accounts. The flaw affects JeecgBoot through 3.9.5 and requires only a valid low-privilege session (PR:L in the CVSS vector), with no user interaction and no special configuration; publicly available exploit code exists, though there is no confirmation of active exploitation in the wild. The independent assessment rates this a genuine, actionable priority: the sole realistic barrier for an attacker is obtaining one low-privilege credential, so internet-exposed instances that permit self-registration are at direct risk.
Unauthenticated remote attackers can exhaust memory and CPU in SillyTavern 1.12.13 through 1.19.0 by sending large or compressed JSON or urlencoded request bodies, because the body-parser middleware processes request bodies before authentication and whitelist checks. Publicly available exploit code exists, and the vendor CVSS 4.0 vector rates this as a network-reachable, unauthenticated flaw (base 8.2); our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms no authentication or special toggle is required, but notes that realistic exploitation requires the operator to have exposed the instance to untrusted networks. Default configurations are affected, though SillyTavern is typically run as a local single-user service bound to localhost or a trusted LAN.
Command execution in Spotweb through 1.5.8 can be triggered through the optional runcommand NZB handler when malicious Usenet spots carry shell metacharacters in their titles; a Spotweb user then has to download the spot so the unescaped title is substituted into $SPOTTITLE and passed to exec(). Exploitation does not require Spotweb authentication, but it is conditional on the runcommand handler being enabled and on passive victim interaction, and code runs with the privileges of the Spotweb PHP process. Publicly available exploit code exists, though no CISA KEV active exploitation is reported; instances without the runcommand integration are not exposed through this path.
Unauthenticated arbitrary file read affects the Divi Plus plugin for WordPress through version 2.4.0, letting any remote attacker retrieve files from the web server via the svg_image parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The endpoint's permission callback returns true unconditionally and the input checks used (sanitize_text_field() and esc_html()) do not block filesystem paths, the file:// stream wrapper, or arbitrary URLs, so the raw contents of the targeted file are returned in the JSON 'html' field; the issue is rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was provided, but successful reads of sensitive files such as wp-config.php could enable follow-on remote code execution.
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any authenticated user - including the lowest-privileged account - can send a DELETE request with the ids parameter set to the special value 'allclear' and wipe the entire sys_log audit table for every user. The result is silent, organization-wide destruction of audit trail evidence rather than data theft, code execution, or privilege escalation, which keeps the real-world impact bounded. Publicly available exploit code exists (a Python PoC script referenced by VulnCheck), and CISA KEV does not list this CVE as confirmed actively exploited (CISA KEV); the vulnerability is confirmed exploited only in the reported PoC sense, not in observed campaigns. CVSS scores of 7.1 (vendor v4.0 and our assessed v3.1) reflect high integrity impact on the log table with low availability impact and no confidentiality impact.
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC connection URLs, database usernames, and decrypted cleartext database passwords from the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController. The handler carries no Shiro permission or role annotations, so a basic application account is sufficient; the only practical hurdles are obtaining any valid session and knowing or enumerating a valid dbSourceCode value, and exposure requires that dynamic datasources be configured on the instance. Publicly available exploit code exists, and the impact is confidentiality-only (CVSS 3.1 6.5 / CVSS 4.0 7.1, PR:L), with no evidence of confirmed active exploitation at time of analysis.
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded /airag/app/queryById endpoint and then read MCP (Model Context Protocol) server configurations - including endpoint URLs, HTTP headers and outbound authentication tokens - because the permission check in AiragMcpController.queryById is commented out. Exploitation requires a valid JeecgBoot session at any privilege level (CVSS v4.0 PR:L, assessed CVSS 3.1 PR:L) and a deployment that actually uses the AiRAG/MCP feature with stored MCP records; a stock install without configured MCP servers exposes nothing sensitive. Publicly available exploit code exists, though the issue is a moderate-priority information-disclosure flaw (high confidentiality impact, no integrity or availability impact) rather than a remote-takeover bug, and no CISA KEV entry indicates confirmed active exploitation.
Information disclosure in Open Source Social Network (OSSN) through 10.1 allows authenticated users to read other users' private message attachments by requesting the /messages/attachment/{guid} route with sequential or guessed file GUIDs. The flaw is an insecure direct object reference (CWE-639) in the default attachment handler, which outputs a file whenever it is typed as a message attachment without verifying that the requesting user is the sender or recipient; no user interaction is required, but a valid low-privileged account and a valid attachment GUID are needed. Publicly available exploit code exists (a HackMD writeup), and a vendor-linked fix commit is referenced, though a released patched version is not independently confirmed, and there is no indication of confirmed active exploitation (CISA KEV).
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext through the GET /sys/api/getUserByName endpoint, which lacks authorization checks. Because the platform exposes its hard-coded AES-CBC encryption key via /sys/getEncryptedString, an attacker holding only a basic account can decrypt the returned password values locally and then subject administrator credentials to offline guessing. Publicly available exploit code exists, and exploitation requires a valid low-privileged account (PR:L) with network reachability, making this a genuine but moderate-priority credential-disclosure issue rather than an unauthenticated critical flaw; no CISA KEV entry indicates confirmed active exploitation at time of analysis.
Tenant ownership takeover in JeecgBoot through 3.9.5 lets any authenticated user - regardless of privilege level - reassign a tenant's owner by sending userId and tenantId to POST /sys/tenant/changeOwenUserTenant, stripping the legitimate owner and potentially installing the attacker or an accomplice as the new owner. The root cause is a missing authorization check (CWE-862) on the multi-tenant owner-change handler, rated CVSS 7.1 (CVSS:4.0 PR:L, UI:N, integrity-only impact), and publicly available exploit code exists. Exploitation is not drive-by: it requires a valid account on the target and a deployment where the multi-tenant feature is enabled, making this an access-control-bounded integrity risk rather than anonymous remote compromise.
Arbitrary file upload in the FV Player 8 WordPress plugin (versions up to and including 8.1.7) allows an authenticated attacker with only subscriber-level access to write attacker-supplied remote file content into the public uploads directory, which can lead to remote code execution if the planted file lands in a web-executable location. The vulnerable path is the new-player-creation flow, which is missing a capability check and invokes check_mimetype(), a function that stores the file before any MIME or extension validation occurs; successfully exploiting this therefore requires winning a race condition between the pre-validation write and the subsequent check, which reduces reliability and may require repeated attempts. Sites that permit open user self-registration effectively expose this to any remote party who can create an account. No public exploit code was identified at time of analysis, and the issue is rated High complexity (AC:H) in our independent assessment versus the vendor vector's AC:L, so exploitation should be treated as feasible but probabilistic rather than trivial.
PHP object injection in the Angio WordPress theme (versions 1.1.1 and earlier) allows authenticated attackers with Subscriber-level access to supply malicious serialized data, potentially achieving remote code execution, file manipulation, or other high-impact outcomes if a usable gadget chain exists in the theme, plugins, or WordPress core. Exploitation requires an authenticated Subscriber account (CVSS vector PR:L), which is often obtainable through open user registration, and no public exploit code or active exploitation has been identified at time of analysis. This is a priority-worthy flaw but not an emergency, as practical impact is contingent on the presence of a gadget chain.
PHP Object Injection in LifterLMS through 10.2.1 requires an authenticated user with the edit_course capability-such as Instructor, Instructor's Assistant, LMS Manager, or Administrator-and is reachable only during lesson creation when a temporary lesson ID enters the custom metadata path in class.llms.admin.builder.php. Although rated high at CVSS 8.8, the plugin contains no POP gadget chain, so exploitation has no impact unless a separate installed plugin or theme provides a usable POP chain; if such a chain exists, an attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on the chain. No public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the Groundhogg CRM, Newsletters, and Marketing Automation WordPress plugin (all versions up to and including 4.9) lets any authenticated user holding the default sales_rep role - which carries edit_contacts, view_notes, and add_notes but not edit_users or promote_users - take over an administrator account. The vulnerable process_edit() handler in the contacts admin page accepts an attacker-supplied 'user' parameter without an ownership or capability check, so a contact can be relinked to an administrator's WordPress user ID; generating a note containing the {auto_login_link} replacement tag then produces a valid permissions-key auto-login URL for that contact, which the attacker reads back through view_notes and visits to authenticate as the administrator. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8), and the flaw requires an existing low-privileged account rather than anonymous access; no public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3) lets an authenticated LatePoint user who holds the settings__edit capability overwrite the default_wp_role_for_customer setting with 'administrator', so that any LatePoint customer account self-registered afterwards is created with full WordPress administrator rights. The flaw is entirely server-side - the role restriction exists only in the UI dropdown and is never validated when the setting is persisted - but it is gated by two real prerequisites: a WordPress administrator must first delegate settings__edit to an agent or custom role, and a new customer registration must occur after the malicious value is saved for the escalation to materialize. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this as a genuine high-impact issue that nonetheless sits below its 8.8 headline score in practical priority.
Authenticated privilege escalation in the FooSales - Point of Sale (POS) for WooCommerce plugin for WordPress (all versions up to and including 1.43.0) allows any account with FooSales Cashier-level access or above to overwrite arbitrary users' email addresses - including an administrator's - and then abuse WordPress's standard password-reset workflow to take over those accounts. The flaw is a missing identity/ownership check (CWE-269) in the plugin's user-details update path, rated CVSS 8.8 with PR:L (authenticated, low privilege) and no user interaction required; the only real barrier is obtaining a Cashier-or-higher role, after which full site compromise is achievable provided email-based password reset is enabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the available data, but the low prerequisite privilege and high confidentiality/integrity/availability impact make this a genuinely high-priority flaw for any site running the affected plugin. Patch status per available data: upstream fix available (changeset/commit); released patched version not independently confirmed.
Authenticated attackers can exploit a PHP Object Injection flaw (CWE-502) in the WordPress plugin Slider by 10Web (slider-wd) versions up to 1.2.62, potentially achieving remote code execution, file manipulation, or data tampering if a suitable POP gadget chain is present. The vulnerability requires low-privilege authentication (CVSS PR:L) and network access with no user interaction, but its real-world impact is contingent on the availability of a gadget chain in WordPress core or other installed components. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting (XSS) in the LTL Freight Quotes WordPress plugin before 4.2.19 enables unauthenticated attackers to inject malicious JavaScript that executes in an administrator's browser session when the admin views the affected administrative page. The flaw arises because values submitted through an unauthenticated endpoint are neither sanitized nor escaped before being stored and later rendered. Although the vendor-assigned CVSS score is 8.8, our independent assessment classifies this as a scope-changing XSS with limited confidentiality and integrity impact (C:L/I:L/A:N) and requiring administrator interaction (UI:R). No public exploit code or active exploitation has been identified, and the vendor has released a patched version (4.2.19).
Incorrect authorization in iflytek SkillHub before 0.2.22 allows account takeover via the self-service account-merge flow: the merge-initiate endpoint returned the verification token directly to the caller and the verify/confirm steps never required the target account to approve from its own authenticated session, so a single low-privilege authenticated user who knows a victim's username or OAuth identity can complete a merge and inherit that victim's API tokens, roles and namespace ownership. Exploitation requires only a valid SkillHub session (PR:L per the CVSS vector - no administrative rights) and works against default deployments because the API enforces the flow even though the /settings/accounts UI remains redirected. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the attack is low-complexity and high-impact, warranting prompt patching; the vendor-released fix is SkillHub 0.2.22.
Unauthenticated SQL injection in the LTL Freight Quotes WordPress plugin (versions 4.2.11 up to but not including 4.2.19) lets remote attackers inject arbitrary SQL through an unsanitised request parameter, giving high-impact read access to the underlying WordPress database - including user credential hashes and any customer or quote data the site stores. Exploitation requires no authentication, no user interaction, and no special configuration beyond an active, network-reachable vulnerable install, and a vendor patch is available in 4.2.19. No public exploit code has been identified at time of analysis, and the practical risk is tempered by the narrow installed base of this specialised less-than-truckload freight-quoting plugin, though sites that have not yet updated remain fully exposed.
SQL injection in the Qode Tours WordPress plugin (all versions up to and including 3.1.3.2) allows a low-privileged authenticated user holding only the Subscriber role to inject arbitrary SQL through plugin-supplied input, exposing sensitive records such as WordPress user credentials and site configuration. Exploitation is remote, low-complexity and needs no user interaction, but it does require a valid account, so sites that allow open self-service registration effectively hand attackers the prerequisite while sites with registration disabled sharply reduce exposure. A published CVSS base of 8.5 reflects a scope-changed vector with confidentiality and availability impact, whereas independent assessment scores the same flaw more conservatively with unchanged scope and confidentiality-only impact; no public exploit code is identified at time of analysis and the issue is not listed in CISA KEV, though the low privilege bar makes it attractive for automated mass scanning.
Authenticated SQL injection in the WordPress plugin Events Manager, affecting versions through 7.4.6, allows a Subscriber-level user - the lowest registered role on a WordPress site - to inject arbitrary SQL into plugin queries, yielding an assessed CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) with high confidentiality impact, low availability impact, and no integrity impact. No end-user interaction is required and the flaw is network-reachable, but the PR:L prerequisite means an outside attacker must first obtain a Subscriber account, which in practice depends on the target site permitting open user self-registration; sites that disable registration substantially raise the barrier to exploitation. No public exploit identified at time of analysis, and the issue was reported through Patchstack - the combination of scope-changed database read impact and a low-privilege foothold makes this a credible, actionable priority rather than an inflated high-CVSS score.
SQL injection in the WordPress plugin Barcode Scanner with Inventory & Order Manager (versions up to and including 1.13.1) lets an attacker who holds a Subscriber-level account inject arbitrary SQL through plugin input, as reported by Patchstack via CVE-2026-62117. The vulnerability is network-reachable, low-complexity and needs no user interaction, and because Subscriber is the lowest standard WordPress role, any site that allows open self-registration effectively exposes the flaw to any visitor who signs up. Patchstack scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), while our independent assessment uses CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N (base 7.1), reflecting high confidentiality impact and limited integrity impact without a scope change; no public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in CellHubs 'ExifTool for photo and video' 5.0.1-gms allows code execution within the app's own sandbox when a media file whose path or filename contains an embedded single quote and shell metacharacters is selected and exported to CSV. The app builds a shell string and passes it to /system/bin/sh -c, wrapping the media path in single quotes without escaping embedded single quotes, so the quoting can be broken out of and the remaining characters interpreted as shell commands. Exploitation is local and requires user interaction: the malicious file must already reside on the device and the victim must manually select it and trigger CSV export; the vulnerability received an assessed CVSS:3.1 score of 8.4 (equivalent 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Authentication requirements are unauthenticated per the CVSS vector (PR:N), meaning no prior privilege on the device is needed for an attacker who can plant the crafted file.
Privilege escalation in the WPMU DEV Forminator WordPress plugin affects every release through 1.57.3 and lets an attacker abuse incorrect privilege assignment logic to obtain capabilities beyond those granted to their account, resulting in high integrity impact and some availability impact. Our independent assessment scores the issue using the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, i.e. network-reachable, low complexity and no user interaction, but with PR:L rather than the vendor-reported PR:N, meaning a low-privileged account is the more likely precondition and any site offering low-privilege registration should treat this as high priority. There is confirmed actively exploited? No - no KEV listing, and no public exploit identified at time of analysis, so this should be prioritized on the basis of the privilege-escalation class and the wide install base of the plugin rather than on observed attacks.
Local file inclusion in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.187) allows unauthenticated remote attackers to pass a crafted 'design_type' parameter through the plugin's tags-widget AJAX path and force the server to include attacker-chosen .php files, which the plugin's own geodir_basic_nonce does not meaningfully impede because that nonce is localized into the geodir_params script object on every public frontend page. The immediately attainable impact is access-control bypass and disclosure of sensitive server-side data, while full arbitrary PHP code execution is conditional on an attacker-controllable .php file already existing on the server or being uploadable to it; the independent assessment rates the vector as AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis. Versions 2.8.188 and later are not affected because design_type is restricted to a fixed allowlist and template names are validated against directory traversal and null bytes.
Replaying a previously-issued OIDC id_token allows unauthenticated attackers to bypass authentication in WPO365 Login (≤44.1) and take over any WordPress account, including administrators. The flaw is gated by the non-default use_id_token_parser_v2 option and requires a valid id_token for the target account. No public exploit code has been identified at time of analysis.
Unauthenticated remote code execution in the Everest Backup WordPress plugin affects all versions through 2.3.13, allowing a network-reachable attacker to inject and execute attacker-controlled code without logging in and without any victim interaction (CVSS 3.1 base 8.1, vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, rooted in CWE-94 code injection). The High attack-complexity rating is the key tempering factor: exploitation hinges on a condition the attacker does not fully control - such as a specific plugin state, timing window, or particular configuration/data value reaching the injection sink - so reachability must be validated per site rather than assumed, and no public exploit code was identified and no CISA KEV listing exists at time of analysis. Sites running the plugin at 2.3.13 or earlier and exposing the vulnerable endpoint to the internet should treat this as high priority; sites that have deactivated or removed the plugin, or that gate the endpoint behind network controls, are not exposed.
Unauthenticated password change against arbitrary WordPress accounts - including Administrator accounts - is possible through the Advanced Form Integration - Connect Forms to 300+ Apps plugin for WordPress in all versions up to and including 2.9.0, letting an attacker submit a public Contact Form 7 form carrying a victim's email address, the field key user_pass, and an attacker-chosen password value. The adfoin_ultimatememberac_send_data handler resolves the target user from the attacker-supplied email and forwards the attacker-controlled key/value pair directly to UM()->user()->update_profile() in the 'account' context, which deliberately bypasses Ultimate Member's banned-key validation and performs no sender identity verification, ownership check, capability check, current-password reauthentication, or sensitive-key restriction (CWE-287). The decisive gate is configuration, not attacker skill: an administrator must already have mapped public form inputs to the Ultimate Member 'Update Profile Field' action, which is why the assessed vector carries AC:H despite PR:N; no public exploit code has been identified at time of analysis.
Broken access control in the WPSection WordPress plugin through version 1.5.1 allows an authenticated subscriber-level user to perform privileged actions that should be restricted to higher-privileged roles, resulting in high integrity and availability impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The flaw is a missing authorization check (CWE-862): the plugin does not verify that the calling user holds the capability the action demands, so any valid low-privileged account on an affected site - the description explicitly cites the Subscriber role - can trigger the vulnerable code paths without user interaction. Only sites running WPSection 1.5.1 or earlier that allow subscriber-level or comparable self-registration are realistically exposed, since an anonymous visitor cannot reach the functionality; no public exploit identified at time of analysis, and the plugin's narrow deployment base limits mass exploitation.
Privilege escalation in the Groundhogg CRM, Newsletters & Marketing Automation plugin for WordPress (all versions through 4.8.3) lets an attacker-controlled account whose user_login is exactly 'groundhogg' and whose user_email matches one of the hardcoded support addresses be silently promoted to administrator when a legitimate admin invokes the plugin's support-access feature. Exploitation is a deliberate two-actor sequence: the attacker must first plant or self-register the matching account (possible when open registration or any other self-service account-creation path exists), after which an admin triggering the submit_ticket or process_send_support_access entry points causes create_support_user() to adopt and promote that account; on multisite the promotion reaches super admin level when the triggering administrator holds manage_network_options, resulting in full site takeover. No public exploit code and no confirmed actively exploited (CISA KEV) status were identified at time of analysis, and the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R reflects both the low-privileged account the attacker must first obtain and the administrative interaction the flaw depends on.
Unauthenticated local file inclusion in the WordPress Backhoe theme (versions 2.0 and earlier, vendor 'mymoun') lets remote attackers cause a server-side PHP include/require construct to load a file path they influence, exposing sensitive local files such as wp-config.php and disclosed configuration data. The supplied CVSS vector is AV:N/AC:H/PR:N/UI:N, and the independent assessment scores confidentiality only (C:H/I:N/A:N), so the practical impact is information disclosure rather than code execution or data modification, with the high attack-complexity component reflecting an unnamed precondition (the specific vulnerable parameter, endpoint, or environment configuration) that must be derived from the Patchstack advisory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation is limited to sites actually running this low-popularity theme, and sites on a patched release or not using Backhoe are unaffected.
Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated local file inclusion in the Flipmart WordPress theme (versions up to and including 2.8, published by ckthemes) allows remote attackers to force the theme's PHP code to include and disclose files on the underlying server. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment) confirms no authentication (PR:N) and no user interaction (UI:N) are needed, but the high attack-complexity rating indicates exploitation depends on specific request parameters, path-traversal or stream-wrapper encoding, or particular PHP/server configuration rather than succeeding against every deployment. The primary demonstrated impact is confidentiality loss (arbitrary file read); escalation to code execution would require includable attacker-influenced content such as logs or uploads and is not established by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch has been identified; a Patchstack advisory documents the issue.
Unauthenticated local file inclusion in the CocoBasic Fabius WordPress theme (versions 1.0 and earlier) allows remote attackers to read arbitrary files on the server via crafted requests that reach an include/require statement. The assessed impact is limited to confidentiality (no integrity or availability impact), and the high attack complexity (AC:H) means successful exploitation depends on specific request crafting and server configuration, such as the presence of poisonable files or permissive PHP wrappers. No public exploit code has been identified and the theme's small deployment footprint further reduces risk, making this a moderate-priority issue.
Unauthenticated local file inclusion in the Teoro WordPress theme (CocoBasic) at versions 1.1 and below lets a remote attacker induce the theme's PHP code to include a locally present file - most critically wp-config.php - exposing database credentials and salts that can be reused to take over the site. The vulnerability requires no credentials (PR:N) and no user interaction (UI:N), but the CVSS AC:H metric indicates a meaningful precondition outside the attacker's direct control (for example a specific request/encoding state or environment configuration), and exposure is limited to sites actively running this specific theme at a vulnerable version; there is no CISA KEV listing and no public exploit identified at time of analysis. The published base score is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the assessed vector lowers integrity and availability impact to L, so real-world risk skews toward moderate rather than critical.
Unauthenticated local file inclusion in the CocoBasic Kaven WordPress theme (versions 1.2 and earlier) allows remote attackers to cause the theme to include and output files from the underlying server, exposing sensitive content such as wp-config.php, credential files, and other data outside the web root. The affected population is limited: Kaven is a niche commercial WordPress theme, so exposure is small compared with core WordPress or high-volume plugins, and no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV. Exploitation is not trivial despite the unauthenticated vector - the CVSS AC:H rating and our independent assessment indicate a required non-default precondition or non-deterministic element (for example a specific theme parameter or feature being reachable, knowledge of an absolute file path, or particular PHP configuration such as allow_url_include) that the public advisory does not fully detail.
Unauthenticated local file inclusion in the Volos WordPress theme (versions 1.2 and below, published by CocoBasic) allows remote attackers to influence a PHP include/require path and pull in arbitrary local files on any site running the affected theme. The vulnerability is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but the high attack complexity score indicates a non-trivial precondition - a specific configuration, path, or environmental state - must be satisfied for reliable exploitation, and the affected installed base is limited to sites actively running Volos. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation is expected to be opportunistic rather than mass-campaign driven.
Unauthenticated local file inclusion in CocoBasic's Cardea WordPress theme (version 2.3 and earlier) lets remote attackers feed attacker-influenced input into a PHP include/require path, exposing arbitrary local files and - per the assessed vector's high integrity impact - potentially enabling code execution or file tampering if the right secondary conditions are met. The flaw needs neither authentication (PR:N) nor user interaction (UI:N), but the high attack complexity (AC:H) indicates a non-trivial precondition or configuration-dependent circumstance that the single Patchstack advisory does not spell out, so reliable exploitation against every default install is not guaranteed. Exploitation is bounded by the requirement that the Cardea theme be installed and active, there is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, making this a moderate-priority issue rather than an emergency.
Unauthenticated local file inclusion in the Mikado Themes 'TouchUp' WordPress theme (all versions below 1.4) lets remote attackers reach a PHP file-inclusion routine without any credentials or user interaction, exposing arbitrary files on the web server. Our assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact with high attack complexity, meaning successful exploitation depends on specific request conditions, path constraints or server configuration and is not guaranteed against every default install. Impact is confined to self-hosted WordPress sites running this specific theme, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is TouchUp 1.4.
Local file inclusion in KuteThemes DukaMarket WordPress theme through version 1.3.0 allows a remote unauthenticated attacker to read arbitrary local files on an affected web server, though the independent assessment limits impact to confidentiality only (C:H/I:N/A:N) rather than integrity or availability. Successful exploitation is constrained by high attack complexity (AC:H), typically requiring a specific traversal or filter-bypass condition, and real-world exposure is limited to WordPress sites running this theme. No CISA KEV entry is present, no public exploit identified at time of analysis, and no EPSS score is supplied; the submitted CVSS 8.1 appears to reflect high integrity/availability impact that the independent assessment does not confirm.
Unauthenticated local file inclusion in the Uminex WordPress theme from Kutethemes affects every release up to and including 1.0.9, allowing a remote attacker who can reach an affected installation to supply crafted input to a PHP file-inclusion code path and read files from the underlying server. Patchstack published the issue at CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment narrows the realistic outcome to disclosure of local files only (C:H/I:N/A:N) with a lower attack complexity, so integrity and availability impact should not be assumed without a demonstrated exploit. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the intelligence; the signals are mixed and point to moderate rather than emergency priority.
Unauthenticated local file inclusion in the Aalto WordPress theme (vendor Edge Themes) at versions 1.8 and earlier allows remote attackers to steer the theme's PHP include/require logic toward attacker-influenced file paths, producing the high confidentiality, integrity, and availability impact reflected in the assessed CVSS of 8.1. The vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so no authentication or user interaction is required but a non-default precondition - such as a specific request parameter, a reachable theme code path, or includable content the attacker can reference - must be satisfied for exploitation to succeed, which is why the issue is context-dependent rather than universally exploitable. Exposure is limited to sites actively running the Aalto theme at 1.8 or below; there is no public exploit identified at time of analysis and the theme is not confirmed actively exploited (no CISA KEV listing).
Unauthenticated local file inclusion (LFI) in the CleanSkin WordPress theme versions 1.5.0 and earlier allows remote attackers to include and potentially execute arbitrary local files, leading to information disclosure or, under specific conditions, code execution. The CVSS score is 8.1 (High), but exploitation requires high attack complexity (AC:H) and the exact vulnerable parameter or endpoint is not disclosed, so the practical risk is tempered. No public exploit code exists at time of analysis, and the Patchstack advisory does not specify a fixed version.
Local file inclusion in the Kids Care WordPress theme through version 3.2.4 allows unauthenticated remote attackers to manipulate a file-inclusion parameter and read local server files, with wp-config.php and other readable files as the primary exposure. The base CVSS vector is 8.1 with High Attack Complexity, but the independent assessment keeps the same unauthenticated and no-user-interaction prerequisites while bounding realistic impact to confidentiality-heavy local file disclosure with Low integrity and availability impact unless log poisoning or PHP wrappers enable escalation. No CISA KEV activity is identified in the provided data, and no public exploit identified at time of analysis; the independent assessment rates this as a credible but not top-tier priority.
Broken access control in the Wordable WordPress plugin (versions up to and including 8.2.10) lets any authenticated Subscriber-level account invoke functionality that should be reserved for higher-privileged roles, yielding high confidentiality and integrity impact (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Reported by Patchstack and rooted in a missing-authorization condition (CWE-862), the issue requires the attacker to already hold or be able to register a low-privilege account, so real-world risk is much greater on sites permitting open user self-registration than on sites where account creation is locked down. No public exploit code was identified at the time of analysis, the CVE is not listed in CISA KEV, and no EPSS data was supplied; treated as a genuine priority-tier vulnerability with a meaningful authentication caveat, it warrants prompt review of plugin exposure and user-registration settings.
Unauthenticated local file inclusion in the Ambient WordPress theme (Elated Themes) at version 1.7 and earlier lets remote attackers coerce the PHP template loader into reading files outside the intended theme path, exposing secrets such as wp-config.php, database credentials, and other server-side data that is echoed back in the response. The vendor vector (AV:N/AC:H/PR:N/UI:N, score 8.1) requires no authentication or user interaction, but the HIGH attack complexity signals a precondition outside the attacker's control must line up for exploitation, so this is not a trivial one-request compromise of every site; our reassessment retains the confidentiality impact while dropping the unconfirmed integrity and availability components. Exposure is limited to WordPress installations running Ambient at 1.7 or below, and no public exploit code has been identified at time of analysis.
Unauthenticated local file inclusion in the KuteShop WordPress theme through version 4.2.9 allows remote attackers to read files from the hosting server - and, given the CWE-98 root cause, potentially to influence which PHP file is included - without any login or victim interaction. The issue is rated CVSS 3.1 8.1 (High) with a network vector (AV:N), no privileges (PR:N) and no user interaction (UI:N), but high attack complexity (AC:H), which indicates exploitation depends on a specific request format, parameter, or theme configuration rather than a trivial default-configuration request. Impact is high across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and reports come from Patchstack, so exposure is limited to sites running this commercial theme with an affected version installed and active.
Unauthenticated local file inclusion in the Boutique WordPress theme from KuteThemes (CPE cpe:2.3:a:kutethemes:boutique) through version 2.3.3 allows a remote attacker to influence a PHP include/require path and read arbitrary local files from the web server without any login or victim interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1, CWE-98). The high attack complexity signals that exploitation is not a simple one-shot request: the attacker must craft a path that survives the theme's filtering and the target's PHP configuration (notably wrapper and allow_url_include settings) before confidentiality, integrity and availability impact materializes at the rated level. There is no public exploit code identified at time of analysis and no CISA KEV listing; the impact beyond local file disclosure - including any escalation to code execution implied by the I:H/A:H sub-scores - is conditional and not confirmed by the description. The only advisory data available is the Patchstack disclosure for the KuteThemes Boutique theme.