Tonda WordPress Theme CVE-2026-28151

The Tonda WordPress theme by Select Themes must be installed and actively set as the site's active theme, running a version below 2.6. No authentication is required (PR:N in CVSS vector). However, the AC:H rating confirms that exploitation is not straightforward against default configurations - a specific bypass condition, parameter encoding technique, or application state must be satisfied; the exact bypass is not described in the available Patchstack advisory. Exploitation is limited by: (1) AC:H indicating non-trivial technical complexity, (2) the niche deployment footprint of this theme reducing opportunistic attack surface, and (3) no confirmed public exploit or POC at time of analysis. The vulnerability does NOT require any logged-in WordPress user session or admin privileges.

The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) signals a serious but not trivially mass-exploitable flaw. The AC:H metric is a meaningful differentiator here: it indicates exploitation is not plug-and-play and likely requires a specific request structure, parameter bypass, or precondition that is not yet publicly documented. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing exists at time of analysis, and no POC code was explicitly referenced in the Patchstack advisory. The full CIA triad impact (H/H/H) reflects the realistic worst-case chain from file read to credential theft to log-poisoning RCE - but the AC:H constraint tempers this for most opportunistic attackers. For WordPress site owners with this niche theme installed, risk is real but lower than a comparable AC:L finding; priority for patching should remain high given the unauthenticated attack surface.

An unauthenticated attacker sends a crafted HTTP GET or POST request to the WordPress site with the Tonda theme active, supplying a manipulated filename parameter (e.g., via path traversal: ../../../../wp-config.php) to the vulnerable PHP include code path. If AC:H conditions are met - such as a specific nonce bypass or parameter encoding - the server returns the contents of the targeted file, exposing database credentials from wp-config.php. In a more severe chain, the attacker first injects PHP code into a log file via a malicious User-Agent header, then uses LFI to include the log file and achieve Remote Code Execution.