Audrey WordPress Theme CVE-2026-42382

Exploitation requires network access to a WordPress site running the Audrey theme version 1.5 or earlier and the ability to reach the specific vulnerable include-handling endpoint; no authentication (PR:N) and no user interaction (UI:N) are needed. Exploitation is limited by the high attack complexity (AC:H) in the CVSS vector, indicating the attacker must satisfy additional prerequisites - plausibly knowledge of the exact parameter/path, valid target file locations, or PHP configuration that permits the relevant stream wrappers - rather than a trivial single-request hit. Escalation from file disclosure to code execution further depends on server configuration such as allow_url_include being enabled or a poisonable log/upload path; the precise triggering parameter is not detailed in the provided data.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1, High) indicates a network-reachable, unauthenticated flaw (PR:N/UI:N) but with high attack complexity (AC:H), implying exploitation depends on non-trivial conditions such as a specific request path, wrapper support, or knowledge of file locations. No EPSS score, no SSVC decision, and no KEV/POC data were provided, so real-world exploitation likelihood cannot be quantified from the inputs. The high complexity and full CIA impact appear driven by the theoretical LFI-to-RCE path of CWE-98; note the tension that the Patchstack tags emphasize Information Disclosure (a confidentiality outcome) while the vector asserts I:H/A:H - the integrity/availability impact should be treated as conditional on a working file-write or remote-include chain rather than confirmed RCE. Absent EPSS/KEV signals, treat this as a genuine but not confirmed-in-the-wild priority: patch promptly on affected sites, but it is not evidence of mass exploitation.

A remote, unauthenticated attacker crafts an HTTP request to a theme endpoint that passes a traversal or wrapper payload (e.g., a file parameter set to ../../../../wp-config.php) into a PHP include, causing the server to render or return the contents of sensitive local files. With database credentials and WordPress auth keys disclosed, the attacker pivots to full site takeover; if remote or log-poisoned content can be included, this escalates to code execution. No public proof-of-concept is identified at time of analysis.