EUVD-2025-210233Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint Snowy theme on target
-
DeliveryIdentify vulnerable include endpoint
-
ExploitSend crafted traversal/wrapper payload
-
ExecutionPHP includes attacker-chosen file
-
PersistRead wp-config.php or poisoned log
-
ImpactPivot to admin takeover or RCE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target site must have the ThemeREX Snowy theme installed and activated at version 1.13 or earlier, and the attacker must be able to reach the vulnerable HTTP endpoint exposed by the theme (typically a WordPress AJAX or theme-template handler accessible without login, consistent with PR:N/UI:N). Exploitation is rated AC:H, indicating a non-trivial precondition - likely a specific parameter name, encoding, or path layout that the attacker must discover or correctly construct - rather than a one-shot URL. Limiting factors include any WAF in front of WordPress, PHP configurations with open_basedir or allow_url_include=Off (which constrain inclusion to local files), and sites that have deactivated the theme even if its files remain on disk. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, unauthenticated bug with full CIA impact but high attack complexity - meaning some non-trivial condition (specific request shape, encoding, or path discovery) must be met. No EPSS score, KEV listing, or public PoC was supplied with this intelligence, so real-world risk skews lower than the raw 8.1 suggests: this looks like a high-impact-if-exploited flaw rather than an actively weaponized one. That said, WordPress theme LFIs are historically a popular target for opportunistic scanners once an advisory drops, and the Patchstack listing increases the chance researchers publish a PoC. Any site still running Snowy ≤1.13 should be treated as high priority despite the absence of confirmed exploitation. |
| Exploit ScenarioDerived | An opportunistic attacker scans WordPress sites fingerprinting the Snowy theme via /wp-content/themes/snowy/ asset paths, then sends a crafted HTTP request to the vulnerable file-inclusion endpoint supplying a traversal payload such as ../../../../wp-config.php to dump database credentials and the AUTH_KEY constants. With those secrets, the attacker pivots to full WordPress administrative takeover and may chain the LFI with a log-poisoning or upload primitive to achieve remote code execution as the web user. No public exploit was identified in the supplied data, so this scenario is inferred from the CWE-98 class and CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated local file inclusion in the Snowy WordPress theme (ThemeREX) versions up to and including 1.13 allows remote attackers to coerce the PHP runtime into including arbitrary files from the server filesystem. The flaw is tracked as CWE-98 (Improper Control of Filename for Include/Require), reported by Patchstack, and carries a CVSS 3.1 score of 8.1 (High) reflecting high-complexity but unauthenticated network exploitation. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - the Patchstack advisory (https://patchstack.com/database/wordpress/theme/snowy/vulnerability/wordpress-snowy-theme-1-13-local-file-inclusion-vulnerability) documents the issue against Snowy ≤1.13 but no fixed version is supplied in this intelligence, so administrators should check the ThemeREX vendor page for an updated build above 1.13 and upgrade as soon as one is released. Until a patched build exists, the most effective compensating controls are deactivating the Snowy theme and switching to an alternative (full mitigation but breaks the site's appearance), or placing a WAF rule in front of WordPress that blocks requests containing directory-traversal sequences (../, %2e%2e%2f), absolute paths, and PHP stream wrappers (php://, file://, data://, expect://) targeting Snowy's AJAX and template endpoints under /wp-content/themes/snowy/ - this preserves functionality but can be bypassed by novel encodings. Hardening PHP via open_basedir and disabling allow_url_include reduces the blast radius from arbitrary code execution to local file disclosure but does not eliminate the bug.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Snowy is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:snowy). The underlying weakness is CWE-98, which describes PHP code that passes attacker-influenced input into include/require statements without adequate filename validation. In a WordPress theme context this typically manifests through AJAX handlers, template-loader endpoints, or shortcode/AJAX dispatchers that take a 'template', 'view', 'file', or similar parameter and concatenate it into an include path. Because PHP's include directive resolves traversal sequences and stream wrappers, an attacker who can reach the vulnerable handler may read or execute server-side PHP files outside the intended directory.
Know when Snowy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable WordPress endpoint with no authentication (AV:N/PR:N/UI:N); AC:H reflects the non-trivial payload construction implied for LFI-to-impact; PHP include yields full read and code-execution impact (C:H/I:H/A:H).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.
Executive ViewAI
The Snowy WordPress theme by ThemeREX (versions ≤1.13) contains an unauthenticated remote file inclusion vulnerability (CVSS 8.1) that exposes organizations to unauthorized server file access. Any WordPress site running this theme is vulnerable to sensitive data leakage, configuration disclosure, and potential code execution without requiring user authentication or credentials. Immediate inventory and remediation across all affected installations is critical.
No vendor-released patch identified at time of analysis. Interim mitigations: Immediately deactivate the Snowy theme, restrict web server read access to theme and configuration directories via filesystem permissions, deploy WAF rules to block LFI payloads (directory traversal patterns in plugin/theme requests), and implement .htaccess restrictions on PHP execution in wp-content/themes. Theme replacement is strongly preferred over prolonged workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB