Teoro WordPress Theme CVE-2026-62068

Exploitation targets the Teoro WordPress theme (cocobasic) at versions 1.1 and below via a file-path parameter that is improperly controlled for a PHP include/require operation (CWE-98), allowing inclusion of local files such as wp-config.php. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the CVSS AC:H metric indicates a limiting prerequisite: successful exploitation depends on conditions outside the attacker's control or requires specialized effort (e.g., a specific request/encoding state or environment configuration rather than a trivial parameter injection). The attack surface is limited to sites actually running this specific theme at the vulnerable version.

Signals are mixed and skew toward moderate real-world risk despite the 8.1 'High' base score. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) confirms a remotely reachable, unauthenticated flaw - attractive to attackers - but the AC:H (high attack complexity) metric indicates exploitation depends on conditions outside the attacker's direct control or requires non-trivial effort, which materially dampens mass-exploitation potential. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; this is 'no public exploit identified at time of analysis.' The claimed impact (C:H/I:H/A:H) is inconsistent with the 'Information Disclosure' / 'LFI' framing of the description: a Local File Inclusion whose primary documented effect is information disclosure would typically warrant high confidentiality but low/no integrity and availability impact - the I:H/A:H values likely reflect CWE-98's theoretical escalation to code execution rather than the demonstrated behavior, so the real impact should be verified with Patchstack. Net: a credible, vendor-reported (Patchstack) unauthenticated flaw worth patching, but the high attack complexity plus absence of KEV/EPSS/POC argues against emergency prioritization relative to lower-complexity unauthenticated bugs.

A remote, unauthenticated attacker crafts a request to a vulnerable Teoro theme endpoint that manipulates a file path parameter to include a local file (e.g., wp-config.php) and disclose sensitive data such as database credentials. The CVSS AC:H metric means success depends on specific conditions (such as a particular request state, encoding, or deployment factor), so exploitation is not fully reliable. No public proof-of-concept is identified in the provided data.