Granola WordPress Theme
CVE-2025-69158
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Granola theme on target
-
DeliveryCraft traversal payload for vulnerable include parameter
-
ExploitSend unauthenticated HTTP request
-
ExecutionPHP include() resolves attacker path
-
PersistRead wp-config.php and site secrets
-
ImpactPivot to DB credentials or log-poison for RCE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a WordPress site running the ThemeREX Granola theme at version 1.13 or earlier and the ability to send HTTP requests to the theme's vulnerable include path; no authentication and no user interaction are required per PR:N/UI:N. The AC:H rating indicates additional non-default conditions are needed - likely knowledge of the specific vulnerable endpoint or parameter name from the Granola theme, and a file path that is readable by the PHP-FPM/Apache user and either contains useful secrets (wp-config.php) or is reachable by a log/session poisoning primitive for code execution. Sites that have already migrated off Granola, or that enforce PHP open_basedir restrictions confining includes to the theme directory, are not exploitable. |
| Impact | The reported CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H rates the issue 8.1 High, with AC:H signalling that exploitation depends on non-trivial conditions such as a specific request shape or environmental state rather than a single trivial parameter swap. EPSS and KEV data were not supplied, and no POC is referenced, so real-world exploitation pressure appears low to moderate today; however, WordPress themes are scanned at scale by commodity tooling and unauthenticated LFI primitives are routinely productised once advisory text drops. The I:H and A:H scoring is debatable for a pure LFI - Patchstack's own tags label this Information Disclosure, suggesting confidentiality impact dominates and the integrity/availability scoring assumes downstream RCE via log poisoning or PHP filter chains rather than direct write/destroy primitives. |
| Exploit ScenarioDerived | An unauthenticated attacker enumerates the target site, identifies a vulnerable Granola theme endpoint accepting a file/template parameter, and issues a crafted HTTP request with a traversal payload such as ../../../../wp-config.php to exfiltrate database credentials and WordPress secret keys. With those credentials the attacker pivots to the database directly or attempts log/session-file poisoning to convert the LFI into PHP code execution under the web server account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated Local File Inclusion in the ThemeREX Granola WordPress theme through version 1.13 allows remote attackers to coerce the PHP runtime into including arbitrary files via attacker-controlled path input. The flaw is reachable over the network without credentials or user interaction and can expose sensitive site files such as wp-config.php, potentially escalating to code execution if log-poisoning or session-file techniques are viable. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Upstream fix availability is not independently confirmed from the supplied data; the Patchstack advisory at https://patchstack.com/database/wordpress/theme/granola/vulnerability/wordpress-granola-theme-1-13-local-file-inclusion-vulnerability should be consulted for the patched release and operators should upgrade Granola to any version higher than 1.13 once published by ThemeREX. Until a patched build is installed, compensating controls include placing a WAF rule that blocks request parameters containing '../', null bytes, or absolute paths against theme endpoints, restricting PHP's open_basedir to the WordPress document root and uploads directory to bound any file read, and disabling allow_url_include and allow_url_fopen in php.ini to prevent remote inclusion variants - note that open_basedir can break plugins that legitimately read outside the webroot and WAF traversal rules generate false positives against pagebuilder URLs. If the theme cannot be patched promptly, switching to an alternative theme is the most reliable mitigation given that LFI in template code is hard to virtual-patch comprehensively.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Granola is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:granola). The root cause is CWE-98, Improper Control of Filename for Include/Require Statement in PHP, meaning a PHP include()/require() call in the theme resolves its path from untrusted request input without canonicalization or allowlist checks. In WordPress themes this pattern typically appears in AJAX handlers, template loaders, or shortcode renderers that accept a 'file', 'template', or 'view' parameter and concatenate it into an include path, allowing directory traversal to any file readable by the web server user.
Know when Granola gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable LFI with confidentiality impact from arbitrary file read; integrity/availability impacts require additional log-poisoning chain not described, so I:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Granola <= 1.13 versions.
Executive ViewAI
The ThemeREX Granola WordPress theme (through version 1.13) contains an unauthenticated file-access vulnerability that could expose sensitive site configuration and lead to complete system compromise. Any organization using this theme faces immediate risk of data breach and website unavailability without urgent remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately deactivate ThemeREX Granola theme; (2) Deploy WAF rules blocking directory traversal and file-inclusion attack patterns; (3) Implement access logging for file system and configuration file reads; (4) Restrict WordPress administrative interfaces to known IP ranges; (5) Conduct forensic log review to determine if prior exploitation occurred; (6) Monitor vendor advisory for patch availability and apply within 24 hours of release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB