AutoParts WordPress Theme CVE-2026-22331

The AutoParts WordPress theme (ThemeREX, versions ≤ 1.5.8) must be installed and active on the target WordPress site, with the vulnerable theme PHP endpoint reachable over the network - no authentication or user interaction is required per PR:N/UI:N. The AC:H qualifier indicates exploitation requires a non-trivial precondition, most likely a specific parameter format, wrapper (e.g., php://filter), or knowledge of a valid file path on the server's filesystem; this limits opportunistic scanning but does not prevent targeted exploitation. PHP configuration directives such as open_basedir restrictions or allow_url_include=Off do not block local inclusion but do constrain what files can be read.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yields 8.1 (High), driven by network reach, no authentication, no user interaction, and full CIA impact - the AC:H qualifier suggests the attacker must satisfy some non-trivial condition (likely a specific parameter shape or wrapper). EPSS and CISA KEV status are not provided in the input, and no public PoC is referenced beyond the Patchstack advisory, so this is currently a high-CVSS issue without confirmed mass exploitation. However, LFI in WordPress themes is historically a high-value target because attackers can routinely chain it to disclose wp-config.php database credentials or achieve RCE via PHP wrappers and uploaded media, so defenders should treat it as a real priority rather than theoretical risk.

A remote attacker crafts an HTTP GET request to a vulnerable AutoParts theme endpoint, supplying a path-traversal or php://filter payload in the parameter that flows into PHP's include/require call. The server returns the contents of wp-config.php, leaking database credentials and WordPress secret keys, which the attacker then uses to authenticate to the database or pivot to authenticated RCE via plugin upload. No public exploit identified at time of analysis, but the bug class is well-understood and trivial to weaponize once the vulnerable parameter is identified.