Snow Club Theme
CVE-2025-69123
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint WordPress site running Snow Club theme
-
DeliveryCraft unauthenticated HTTP request with traversal payload
-
ExploitTrigger vulnerable PHP include in theme
-
ExecutionRead wp-config.php and sensitive files
-
PersistLog-poison or upload to stage PHP
-
ImpactExecute arbitrary code as web user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target WordPress site must have the ThemeRex Snow Club theme version 1.1 or earlier installed and activated, with the vulnerable theme PHP endpoint reachable over the network (default WordPress deployment exposes /wp-content/themes/ and admin-ajax.php). No authentication, user interaction, or non-default configuration is required (PR:N/UI:N), but AC:H in the CVSS vector indicates the attacker must craft a specific request - likely identifying the correct parameter name and bypassing any partial path filtering - rather than a trivial single-parameter inclusion. PHP's allow_url_include and open_basedir settings, plus whether log files or uploads are reachable from the include path, will determine whether the LFI escalates to RCE or remains read-only. |
| Impact | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yields 8.1 (High): network-reachable, unauthenticated, no user interaction, with full CIA impact, tempered only by AC:H suggesting some non-trivial condition (likely a specific parameter or request shape). EPSS and SSVC data were not provided, and the issue is not in CISA KEV, so there is no evidence of active exploitation; likewise no POC is referenced in the Patchstack advisory shown. Real-world risk is meaningful but bounded by the niche install base of a single commercial theme - operators running Snow Club <= 1.1 should treat it as priority-patch given LFI on WordPress historically chains to RCE via log poisoning or wp-config disclosure, while broader fleets without this theme face no exposure. |
| Exploit ScenarioDerived | An attacker enumerates WordPress sites running the Snow Club theme (e.g., via fingerprint of /wp-content/themes/snow-club/) and sends a crafted unauthenticated HTTP request to a vulnerable theme endpoint with a path-traversal payload in the include parameter, reading /etc/passwd or wp-config.php to harvest database credentials and authentication keys. With wp-config secrets in hand, the attacker pivots to the database or uses log-poisoning to escalate the LFI to remote code execution under the web server user; no public POC is referenced, but the CWE-98 pattern is well understood and routinely weaponized in WordPress ecosystems. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated local file inclusion in the ThemeRex Snow Club WordPress theme versions 1.1 and earlier allows remote attackers to include and execute arbitrary local files on the host, leading to sensitive file disclosure and potential remote code execution. The flaw is reported by Patchstack and maps to CWE-98 (PHP file inclusion); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - the Patchstack advisory does not cite a fixed version, so administrators should monitor ThemeRex for an update beyond 1.1 and apply it as soon as available (advisory: https://patchstack.com/database/wordpress/theme/snow-club/vulnerability/wordpress-snow-club-theme-1-1-local-file-inclusion-vulnerability). In the interim, deploy a WAF rule (Patchstack, Wordfence, or ModSecurity) that blocks path-traversal sequences (../, encoded variants, php://, data://, file:// wrappers) on requests to the theme's PHP endpoints; the side effect is potential false positives on legitimate parameters containing dots. Operators can also switch to an alternative theme temporarily, harden PHP by setting open_basedir to the WordPress root and disabling allow_url_include, and restrict file permissions on wp-config.php and log files to reduce the blast radius of any successful include - accepting that these controls reduce but do not eliminate exposure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Snow Club is a commercial WordPress theme distributed by ThemeRex (CPE cpe:2.3:a:themerex:snow_club). The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), meaning a PHP include()/require() call inside the theme consumes attacker-controllable input - typically a request parameter passed through a theme template loader, AJAX handler, or shortcode renderer - without restricting it to an allowlisted path. Because WordPress themes execute in the context of the web server's PHP process, an included file is parsed as PHP if it contains PHP tags, turning a path-traversal primitive into arbitrary local file read and, where uploaded or log-poisoned content is reachable, code execution.
Know when Snow Club gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable WordPress theme, no auth or interaction (PR:N/UI:N); AC:H reflects need to identify specific vulnerable parameter; LFI commonly yields full CIA impact via wp-config disclosure and log-poisoning to RCE.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.
Executive ViewAI
Organizations running the ThemeRex Snow Club WordPress theme (version 1.1 and earlier) face a critical security gap: an unauthenticated vulnerability allows remote attackers to access sensitive server files and potentially execute unauthorized code without credentials. No vendor patch is currently available, creating urgent exposure for any website relying on this component.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately replace or deactivate the affected theme-this is the primary control; (2) Deploy Web Application Firewall rules to block requests containing '../' sequences and common file inclusion attack patterns; (3) Restrict file system permissions on WordPress configuration and sensitive data files; (4) Enable and monitor web server access logs for suspicious file traversal requests targeting config files; (5) Implement network-level access restrictions limiting direct file system exposure where possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB