EcoBlue Theme CVE-2026-22338

Target must be a WordPress site running the ThemeREX EcoBlue theme at version 1.15 or earlier with the vulnerable theme endpoint reachable over HTTP/HTTPS (default for any public WordPress installation using this theme). No authentication, user interaction, or non-default plugin configuration is required per CVSS PR:N/UI:N. Limiting factors: the CVSS AC:H rating indicates the attacker must satisfy a non-obvious precondition - likely knowledge of the specific vulnerable parameter name, a particular request path, or encoding required to bypass partial filtering - and the impact ceiling depends on PHP runtime settings (allow_url_include, open_basedir, file permissions) governing what files can be included and whether code execution is achievable beyond source disclosure.

CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - unauthenticated, network-reachable, no user interaction, full CIA impact, but with high attack complexity. The High AC is unusual for a typical LFI and suggests Patchstack assessed that some non-trivial precondition (specific parameter, configuration, or encoding) is needed. No EPSS score was supplied, the issue is not in CISA KEV, and no public PoC was indexed in the references - so this is no public exploit identified at time of analysis. Real-world risk is moderate-to-high: WordPress themes are widely deployed and indexable by attackers via wpscan-style fingerprinting, but the AC:H rating and lack of observed exploitation argue against treating this as an emergency over confirmed actively-exploited issues. The reference set is thin (a single Patchstack advisory) and the underlying vulnerable parameter is not disclosed publicly, which limits independent verification.

An unauthenticated attacker fingerprints a WordPress site running the EcoBlue theme (visible in HTML source or via /wp-content/themes/ecoblue/), then issues a crafted GET request to a vulnerable theme endpoint with a path-traversal payload such as ?file=../../../../wp-config.php to read database credentials and authentication keys. With those credentials the attacker authenticates to the database or escalates via session/log poisoning to achieve PHP code execution. No public exploit identified at time of analysis, but the WordPress theme attack surface is heavily targeted by automated scanners.