EUVD-2025-210193Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint Planty theme version
-
DeliveryCraft LFI request with traversal payload
-
ExploitSend unauthenticated HTTP request to vulnerable endpoint
-
ExecutionPHP include() resolves attacker-controlled path
-
PersistRead wp-config.php or chain via php:// wrapper
-
ImpactExfiltrate DB credentials or achieve RCE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target WordPress site to have the Planty theme by ThemeREX installed and active at version ≤1.14.0, and the attacker must reach the specific vulnerable theme endpoint over HTTP/HTTPS without credentials (PR:N, UI:N). The CVSS AC:H rating indicates additional non-trivial conditions must be satisfied - likely specific parameter values, encoding, or server-side PHP configuration (e.g., allow_url_include enabled for wrapper-based RCE, or readable target paths within open_basedir) - which the advisory does not enumerate in the provided data; exploitation is therefore limited to sites running the affected theme version with a PHP configuration permissive enough for the chosen file inclusion technique to succeed. |
| Impact | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yields 8.1 (High) and is driven by unauthenticated network reach combined with full CIA impact, tempered by high attack complexity - meaning a non-trivial precondition (e.g., specific request crafting, race, or environmental state) must be met. No EPSS score, KEV listing, or public PoC was provided in the input, so real-world exploitation probability cannot be quantified; the absence of KEV/PoC combined with AC:H suggests opportunistic mass exploitation is less likely than targeted abuse against known Planty installations. Defenders should still treat this as high priority because LFI in PHP frequently chains to RCE via log poisoning or wrapper abuse, and WordPress themes are easily fingerprintable by attackers scanning for /wp-content/themes/planty/. |
| Exploit ScenarioDerived | An attacker fingerprints WordPress sites running the Planty theme by requesting a known theme asset, then sends a crafted unauthenticated HTTP request to the vulnerable theme endpoint with a manipulated file/template parameter pointing at wp-config.php or a php:// wrapper. Successful inclusion leaks database credentials and WordPress secret keys, and where log files or uploaded content are reachable, the attacker pivots to remote code execution via PHP filter chains or log poisoning. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated local file inclusion in the Planty WordPress theme versions 1.14.0 and earlier allows remote attackers to coerce the PHP application into including arbitrary files from the server filesystem, leading to disclosure of sensitive configuration data and potential code execution. The flaw is reachable without credentials over the network but rated AC:H, indicating exploitation requires meeting specific conditions; no public exploit identified at time of analysis and the issue is tracked by Patchstack and ENISA EUVD-2025-210193.
RemediationAI
No vendor-released patch identified at time of analysis from the provided data - the Patchstack advisory does not list a fixed version in the inputs available, so administrators should monitor the ThemeREX vendor changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/planty/vulnerability/wordpress-planty-theme-1-14-0-local-file-inclusion-vulnerability) for an updated Planty release above 1.14.0 and upgrade immediately when published. Until a patched theme version is available, compensating controls include deploying a WordPress-aware WAF rule (Patchstack, Wordfence, or ModSecurity CRS) to block requests containing path traversal sequences (../, php://, file://, data://) targeting Planty theme endpoints under /wp-content/themes/planty/, disabling the allow_url_include PHP directive and restricting open_basedir to the WordPress document root to limit which files PHP can include, and temporarily deactivating the Planty theme on high-value sites if a maintenance theme is acceptable - noting that WAF rules can be bypassed via encoding and that deactivating the theme will break site presentation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Planty is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:planty), commonly deployed on plant-shop and gardening WordPress sites. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), where user-controlled input is passed into a PHP include/require construct without proper validation or path canonicalization. In WordPress themes, this pattern typically arises from AJAX endpoints, template loaders, or shortcode handlers that accept a file or template name parameter and concatenate it into an include() call, allowing path traversal sequences or absolute paths to redirect inclusion to unintended files such as wp-config.php or PHP wrappers.
Know when Planty gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable LFI in a PHP theme (AV:N/PR:N/UI:N); AC:H reflects undisclosed exploitation preconditions; LFI to wp-config and potential RCE yields C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.
Executive ViewAI
The Planty WordPress theme (versions 1.14.0 and earlier) contains an unauthenticated file inclusion vulnerability that allows attackers to exfiltrate sensitive configuration data and execute arbitrary code on affected websites. Organizations running this theme face immediate risk of credential theft, data breach, and complete site compromise. Rapid inventory and mitigation are required to prevent active exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deactivate and replace the theme with a maintained alternative; (2) Deploy Web Application Firewall rules to block path traversal and file inclusion payloads; (3) Restrict network access to administrative interfaces; (4) Enable detailed application logging to detect exploitation attempts; (5) Increase monitoring frequency of affected sites for unauthorized file access or code execution indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB