Uminex WordPress Theme CVE-2026-48193

The Uminex WordPress theme (by Kutethemes) version 1.0.9 or earlier must be installed and active on the target site; exploitation is network-based and requires no authentication and no user interaction (PR:N/UI:N), with the attacker supplying attacker-controlled input to a file-inclusion code path (CWE-98). The published vector's AC:H indicates a limiting precondition for reliable exploitation that is not described in the available data - the exact feature, parameter, or configuration that gates the include is undocumented and should be confirmed against the Patchstack advisory. The primary realistic outcome is disclosure of local files (consistent with the 'Information Disclosure'/'LFI' tags); escalation to integrity/availability impact would require further conditions not stated.

Signals are mixed and lean toward moderate real-world priority rather than emergency. The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects an unauthenticated, network-reachable flaw with full CIA impact, but the High attack complexity (AC:H) tempers it - the scorer judged that some non-trivial condition must be met for reliable exploitation, which is unusual for a plain LFI and is not explained in the sparse description. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The I:H/A:H ratings in the supplied vector are also in tension with the 'Information Disclosure' and 'LFI' tags, which imply a read-oriented file-disclosure bug; achieving integrity/availability impact (e.g., code execution) from an LFI typically requires additional conditions (log poisoning, session/wrapper tricks) not documented here - verify with the Patchstack advisory. Net: a credible unauthenticated disclosure issue in a WordPress theme worth patching, but the absence of exploitation signals plus AC:H and a niche deployment footprint argue against treating it as an active mass-exploitation threat.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Uminex theme (<=1.0.9), manipulating a file-path parameter handled by a vulnerable PHP include so the application reads an arbitrary local file (e.g., wp-config.php) and returns its contents. No authentication or user interaction is required (PR:N/UI:N), though the High attack complexity in the published vector suggests some non-default precondition may be needed for reliable exploitation. No public exploit code was identified in the provided data.