TechOne WordPress Theme CVE-2026-62094

Affects the TechOne WordPress theme at versions 3.0.3 and earlier; exploitation requires reaching the vulnerable theme endpoint that passes attacker-supplied input into a PHP file-inclusion call, with no authentication needed (PR:N) and no user interaction (UI:N). The key limiting factor is CVSS AC:H: success depends on conditions the attacker does not fully control (e.g., specific path/encoding requirements, server configuration such as allow_url_include, or reachable log/upload paths to escalate read into code execution), which prevents trivial, universal exploitation. Escalation beyond local file disclosure to code execution is not confirmed from the available data.

Signals are mixed and lean toward moderate real-world priority despite the high 8.1 CVSS base score. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms a network-reachable, unauthenticated flaw, which raises concern, but the AC:H rating indicates the attacker must satisfy non-trivial or non-deterministic conditions to succeed, dampening mass-exploitation potential. No EPSS score was supplied, this CVE is not on the CISA KEV list, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The sole source is a Patchstack advisory, which is a reputable WordPress vulnerability database but a single source. Note the conflict between the input's full C:H/I:H/A:H impact claim and the vendor tagging of 'Information Disclosure'/'LFI', which suggests the primary realistic impact is confidentiality (file read); the integrity/availability highs are likely predicated on file-inclusion escalating to code execution (consistent with CWE-98) and should be verified against the actual code path. Overall this is a credible but not urgent issue: high severity on paper, limited by AC:H and the absence of exploitation evidence, affecting a niche WordPress theme.

A remote, unauthenticated attacker crafts a request to a vulnerable endpoint of a WordPress site running the TechOne theme (<= 3.0.3), supplying a manipulated file-path parameter that the theme passes into a PHP include/require. This allows reading sensitive local files (e.g., wp-config.php) and, where file-inclusion can reach attacker-controlled content, potentially executing PHP. No public exploit code is identified, and the CVSS AC:H rating implies success depends on conditions not guaranteed in every deployment.