EUVD-2025-210232Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Quirky theme on target
-
DeliverySend crafted request with traversal payload
-
ExploitPHP include() loads attacker-controlled path
-
ExecutionRead wp-config.php or include staged PHP
-
PersistExecute code as web user
-
ImpactPivot to database and admin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the WordPress site running ThemeREX Quirky theme version 1.23 or earlier with the vulnerable include/template-loading endpoint exposed; no authentication or user interaction is needed (PR:N, UI:N). Limiting factors per the CVSS vector include high attack complexity (AC:H), implying the attacker must satisfy a non-trivial precondition such as identifying the correct parameter, bypassing partial input filtering, or staging an includable PHP file via an upload or log-poisoning side channel for full RCE rather than mere file disclosure. The flaw applies only to deployments where the Quirky theme is the active theme (or its files are loaded), not to arbitrary WordPress installs. |
| Impact | Patchstack rates this CVSS 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - network reachable, no authentication, no user interaction, but high attack complexity, with full CIA impact reflecting the LFI-to-RCE potential typical of PHP include flaws. The lack of a CISA KEV listing and no public exploit code lower immediate real-world urgency, and AC:H suggests some non-trivial precondition (such as a specific request shape or a reachable file path). However, Patchstack-tracked WordPress theme LFIs have a history of being weaponised quickly once disclosed, and EPSS data is not provided in the input so probabilistic exploitation likelihood cannot be quantified here. Confidence in the C:H/I:H/A:H impact is moderate - the one-line description does not confirm whether code execution is reachable or whether the impact is limited to file disclosure, so the assigned vector may overstate integrity/availability impact. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP request to a Quirky theme endpoint (for example a template-loader or AJAX action) supplying a path-traversal payload in a parameter that feeds into a PHP include/require, causing the server to disclose wp-config.php database credentials or include an attacker-staged log/upload file to achieve PHP code execution. The AC:H rating implies the attacker must discover the specific vulnerable endpoint and parameter combination, and possibly stage an includable file via a separate upload primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated local file inclusion in the ThemeREX Quirky WordPress theme versions 1.23 and earlier allows remote attackers to include and disclose arbitrary local files on the server. The flaw stems from improper control of filename for include/require statements (CWE-98), which can escalate to remote code execution if attackers can plant or reach an includable PHP payload. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis; the Patchstack advisory at https://patchstack.com/database/wordpress/theme/quirky/vulnerability/wordpress-quirky-theme-1-23-local-file-inclusion-vulnerability does not cite a fixed version, so administrators should monitor ThemeREX for an update beyond 1.23 and apply it as soon as released. As compensating controls, restrict access to the theme's PHP endpoints via web server rules or a WAF (Patchstack and Wordfence both provide virtual patches for theme LFIs), set open_basedir and disable allow_url_include in php.ini to constrain include() targets, and harden file permissions on wp-config.php and other sensitive files - note these mitigations may break theme features that legitimately load template files dynamically. If the theme is unmaintained, the most defensible action is to switch to an actively maintained theme.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Quirky is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:quirky:*). The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), meaning a PHP include/require path is constructed from attacker-controlled input without proper validation. In WordPress themes this pattern typically occurs in AJAX handlers, template-loader endpoints, or shortcode handlers that take a 'file', 'template', or 'view' parameter and pass it into include/require, allowing path traversal to arbitrary local PHP or sensitive configuration files such as wp-config.php.
Know when Quirky gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects non-trivial preconditions for RCE; confidentiality high for file disclosure, integrity/availability low absent confirmed code execution.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.
Executive ViewAI
The ThemeREX Quirky WordPress theme (versions 1.23 and earlier) contains a critical vulnerability allowing unauthenticated attackers to read arbitrary files from affected servers. This exposure threatens confidential data, configuration credentials, and database connection strings. If attackers can place malicious PHP code on the server, the vulnerability escalates to complete system compromise. Organizations deploying this theme face immediate risk requiring urgent remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deploy WAF rules to block file inclusion exploitation attempts; (2) Disable PHP execution in upload directories and restrict write permissions; (3) Implement strict input validation on all theme parameters; (4) Monitor web server logs for file inclusion attack signatures; (5) Restrict file system permissions to limit sensitive file exposure; (6) Consider offline maintenance or theme disabling on production systems until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB