EUVD-2026-37675Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Malmö theme
-
DeliverySend crafted request to theme endpoint
-
ExploitTraverse path to sensitive file
-
ExecutionPHP include reads target file
-
ImpactDisclose credentials or escalate to code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target WordPress site must have the elated-themes Malmö theme installed and active at version 2.2 or earlier, and the vulnerable theme endpoint (a PHP include/require sink reachable from a theme-served URL or AJAX action) must be network-reachable to the attacker. No authentication is required (PR:N), but AC:H indicates the request must satisfy specific preconditions - likely a particular parameter name, path encoding, or sink-reachable file layout - rather than a trivially repeatable one-shot payload. Exploitation is limited to sites still running this specific theme; sites that have switched themes or removed Malmö files from the WordPress themes directory are not exposed. |
| Impact | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N indicates a network-reachable, unauthenticated vulnerability with high impact on confidentiality, integrity, and availability, but with high attack complexity - implying non-trivial conditions (specific parameters, encoding, or environment) are needed to exploit reliably. No EPSS score, KEV listing, or public POC was provided, so real-world exploitation pressure is currently low. The vendor (elated-themes) advisory or fixed version is not present in the provided references - only a Patchstack database entry is cited - so the patch status cannot be confirmed from this data. Risk is meaningful for any site still running Malmö <= 2.2, but prioritization should account for the AC:H qualifier and absence of observed exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP GET or POST request to a theme-handled endpoint with a manipulated filename parameter pointing to a sensitive file such as wp-config.php or /etc/passwd, causing the PHP include sink to read and disclose the file's contents. If the attacker can stage controlled content (uploaded media, log poisoning) and reference it through the inclusion path, the LFI can be escalated to PHP code execution under the webserver user. No public exploit identified at time of analysis, and the CVSS AC:H suggests non-default request shaping is needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated local file inclusion in the Malmö WordPress theme versions 2.2 and earlier allows remote attackers to include arbitrary local files via crafted requests, enabling disclosure of sensitive server-side content and potentially remote code execution. The flaw is reported by Patchstack and classified as CWE-98 (improper control of filename for include/require), with no public exploit identified at time of analysis. Affected sites are WordPress installations using the elated-themes Malmö theme.
RemediationAI
No vendor-released patch identified at time of analysis from the provided references - the only cited source is the Patchstack database entry at https://patchstack.com/database/wordpress/theme/malmo/vulnerability/wordpress-malmoe-theme-2-2-local-file-inclusion-vulnerability, which should be consulted for an updated fix version once published by elated-themes. Until a patched theme version is confirmed, operators should deactivate the Malmö theme and switch to a maintained alternative (this will break the site's existing presentation), or place the site behind a WAF with rules blocking path-traversal sequences (../, encoded variants) and absolute paths in query parameters routed to theme endpoints (rules may produce false positives on legitimate theme requests). Restricting the WordPress installation with PHP open_basedir and ensuring file permissions prevent reading of wp-config.php by the webserver user reduces the impact of any successful inclusion.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in a PHP include/require statement within the Malmö WordPress theme (CPE cpe:2.3:a:elated-themes:malmö) where user-controllable input is used to construct a filesystem path without sufficient sanitization. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion') indicates the affected code path likely passes attacker-supplied data into include(), require(), or similar functions. In a WordPress theme context this typically manifests as a theme template loader, AJAX handler, or query parameter that selects a file to render, where path traversal sequences or absolute paths reach the include sink.
Know when Malm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects non-trivial conditions; high confidentiality, but integrity and availability impact only realistic if LFI is chained to RCE.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.
Executive ViewAI
The Malmö WordPress theme (versions 2.2 and earlier) contains an unauthenticated file inclusion vulnerability allowing remote attackers to read sensitive server files and potentially execute code on affected installations. This poses immediate data breach and site compromise risk to all WordPress properties running this theme across the organization's digital footprint.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement WAF rules blocking path traversal sequences (../, encoded variants) targeting WordPress theme directories; (2) Restrict web-accessible file permissions on theme folders to read-only; (3) Disable direct HTTP access to theme PHP files via .htaccess or web server configuration; (4) Remove or immediately deactivate vulnerable theme; (5) Enable comprehensive file access logging and alerting for attempts to access non-standard files; (6) Migrate to actively-maintained alternative WordPress themes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB