EUVD-2026-20365
GHSA-c4fh-xf35-vp6g
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Homeo homeo allows PHP Local File Inclusion.This issue affects Homeo: from n/a through <= 1.2.59.
AnalysisAI
Local File Inclusion in ApusTheme Homeo WordPress theme versions ≤1.2.59 allows authenticated attackers with low privileges to read arbitrary files on the server via improper file inclusion controls. The vulnerability stems from insufficient validation of file paths in PHP include/require statements, enabling access to sensitive configuration files, credentials, or other restricted content. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Audit current ApusTheme Homeo version across all WordPress installations and identify systems running version ≤1.2.59. Within 7 days: Restrict administrative and contributor access to only necessary users; implement file permission restrictions (644 on wp-config.php and other sensitive files) and disable PHP file execution in wp-content directories via .htaccess rules. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today