Vino Theme CVE-2026-65481

Exploitation requires an authenticated WordPress account at Contributor privilege level on a site running the Vino theme version 1.9 or earlier (PR:L confirms authentication is needed; the CVE title explicitly scopes this to the Contributor role). It is network-reachable with no victim interaction (AV:N/UI:N), but limited by two concrete factors: the attacker must already hold or obtain Contributor access, and the CVSS attack complexity is rated High (AC:H), meaning success depends on additional conditions such as a specific parameter, path, or server state beyond a single default request. Sites that do not grant Contributor accounts to untrusted users, or that do not run the Vino theme, are not exposed.

The supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5 High) shows a network-reachable but authentication-gated issue: PR:L means a Contributor-level WordPress account is required, and AC:H signals additional conditions that raise the bar beyond a trivial single request. No EPSS score, SSVC decision, KEV entry, or POC was provided in the intelligence, so the probabilistic-exploitation signal is simply absent rather than low - this should be treated as unknown, not safe. The C:H/I:H/A:H triad from Patchstack is broad for what the tags describe as 'Information Disclosure / LFI', so there is some tension: a pure file-read LFI justifies high confidentiality but the integrity/availability highs likely assume the CWE-98 include primitive can reach code execution - verify the actual impact against the Patchstack advisory before treating I/A as confirmed. Net: a genuine but not top-tier priority - meaningful for any site that grants untrusted users Contributor accounts, lower urgency for closed editorial teams.

An attacker registers or compromises a low-privileged Contributor account on a WordPress site running the Vino theme, then submits a crafted request to the vulnerable theme parameter with a traversal/path value pointing at a sensitive server file such as wp-config.php, causing the theme to include and return its contents (database credentials, secret keys). No public POC was provided, and the CVSS AC:H indicates the attacker must satisfy extra conditions rather than firing a single trivial request.