Shuffle Theme CVE-2025-15637

Exploitation requires no authentication (CVSS PR:N) and no user interaction (UI:N), meaning any unauthenticated HTTP client can attempt the attack against an internet-exposed WordPress installation running Shuffle theme version 1.8 or earlier. The CVSS AC:H metric indicates a specific complexity barrier must be overcome - this likely corresponds to a non-default PHP configuration, a precise knowledge of the vulnerable parameter name and acceptable path format, or a multi-step attack chain (e.g., log poisoning) to achieve the full high-impact outcome. The vulnerability is limited to sites where the Shuffle theme is active (not merely installed); deactivated themes are not served by WordPress. Exploitation is further constrained by the web server process's filesystem permissions - files outside the web root or owned by root with restrictive permissions may be unreadable even if the LFI path resolves. The AC:H barrier limits the realistic risk from mass-automated scanning, but targeted exploitation by a skilled attacker remains viable.

The CVSS 8.1 score reflects a high-severity finding driven by network accessibility (AV:N), no authentication requirement (PR:N), no user interaction (UI:N), and high confidentiality, integrity, and availability impact. The AC:H metric is the principal mitigating signal - it indicates that exploitation is not straightforward and likely requires specific conditions such as a precisely crafted payload, a particular server filesystem layout, or a secondary technique (e.g., log poisoning) to achieve the full C:H/I:H/A:H impact. EPSS data was not provided in the input, so exploitation probability cannot be quantified. No CISA KEV listing exists, and no public POC has been identified, which reduces the immediate weaponization risk. Defenders should treat this as high priority for WordPress sites running this theme, but the AC:H factor means mass-automated exploitation is less likely than for AC:L LFI variants. The combination of PR:N and AV:N means any internet-exposed WordPress installation running Shuffle <= 1.8 is within the attack surface.

An unauthenticated attacker identifies a WordPress site running Shuffle theme 1.8 or earlier and sends a crafted HTTP GET or POST request containing a path-traversal payload targeting the vulnerable file-inclusion parameter, directing PHP to include a sensitive local file such as /var/www/html/wp-config.php. The retrieved file contents expose database credentials and secret keys, enabling lateral movement into the database or forging WordPress authentication cookies. Under configurations where web server logs are readable by PHP, the attacker may first inject PHP code into a log file via a crafted User-Agent header, then include that log to achieve remote code execution. No public POC has been identified at time of analysis, but the attack pattern is a well-understood LFI technique requiring moderate skill.