ChapterOne WordPress Theme CVE-2026-40731

Exploitation requires that the target WordPress site has the Mikado-Themes ChapterOne theme installed and active at version 1.7 or earlier, and that the attacker can reach the vulnerable theme endpoint over HTTP/HTTPS - typical for any internet-exposed WordPress install. No authentication or user interaction is required (PR:N/UI:N). The AC:H rating indicates a non-trivial attack complexity, meaning the attacker likely needs to know the specific vulnerable parameter name and request shape (not disclosed in the public description), and successful escalation from file disclosure to code execution further depends on PHP configuration (allow_url_include, available log/upload paths writable by the web user) which is not guaranteed in hardened deployments.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1) signals unauthenticated remote reach with high impact across confidentiality, integrity and availability, tempered by high attack complexity - likely reflecting that exploitation depends on specific parameter knowledge or a particular request shape rather than a trivial GET. There is no KEV listing and no EPSS score provided, and Patchstack discloses the issue without bundling a public PoC, so this is currently a theoretical-to-opportunistic risk rather than confirmed active exploitation. Real-world priority is elevated by the unauthenticated nature and by WordPress's tendency to attract mass scanners that quickly weaponize Patchstack disclosures, so defenders running ChapterOne should treat it as high priority even though widespread exploitation is not yet evidenced.

An unauthenticated attacker sends a crafted HTTP request to a ChapterOne theme endpoint (for example an AJAX action or template-loading parameter) supplying a traversal-encoded path that resolves to wp-config.php, retrieving database credentials and WordPress secret keys from the response. With those credentials the attacker can pivot to direct database access or, if log files or uploaded content are includable, escalate the LFI into PHP code execution by including a poisoned log entry or uploaded image containing PHP.