Grevo WordPress Theme CVE-2025-62029

Exploitation targets the Grevo WordPress theme at versions from an unspecified start through ≤ 2.4, via a script that passes attacker-influenced input into a PHP include/require statement (CWE-98). The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N), but AC:H signals that success depends on conditions not fully under the attacker's control - likely a specific vulnerable code path, parameter, or server configuration (for classic PHP remote inclusion, PHP settings such as allow_url_include being enabled would be a limiting prerequisite; a local-inclusion variant would require a reachable include parameter). The practical limiter is that the site must have the vulnerable Grevo theme installed and active, and the exact triggering parameter/endpoint is not detailed in the available data.

This is a genuinely high-severity flaw on paper (CVSS 8.1, C:H/I:H/A:H) but the real-world priority is tempered by several signals. The CVSS vector is network-based and unauthenticated (AV:N/PR:N/UI:N), which is the worst case, but it carries AC:H (high attack complexity), meaning exploitation depends on conditions outside the attacker's full control. The EPSS score is low at 0.46% (38th percentile), indicating the predictive models do not expect widespread exploitation in the near term. There is no CISA KEV listing and no public exploit code identified, so there is no evidence of active exploitation. There is also a notable classification tension: the CWE (CWE-98) and the official description both describe 'PHP Remote File Inclusion' (which typically enables remote code execution and justifies the C:H/I:H/A:H impact), yet the Patchstack tags label it 'LFI' and 'Information Disclosure' and the reference URL title says 'Local File Inclusion.' This is a conflict in impact characterization - RFI (potential RCE) versus LFI/info-disclosure - and it should be verified against the Patchstack advisory before treating this as full RCE. Net: a real but not urgent issue - patch on a normal cadence; it is not a mass-exploitation emergency given low EPSS, no KEV, no POC, and AC:H.

A remote, unauthenticated attacker targets a WordPress site running the Grevo theme (≤ 2.4) and sends a crafted request to a theme script whose include/require path is influenced by attacker-controlled input, causing the application to include an external or attacker-specified PHP payload. If true RFI as the CWE indicates, this leads to arbitrary PHP code execution in the web server context; if the behavior is closer to local inclusion as the tags suggest, impact may be limited to disclosure of local files. No public proof-of-concept exploit has been identified at time of analysis.