EUVD-2026-57980
GHSA-h7c8-vx4q-xf5p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Subscriber-level auth (PR:L) required; network-exploitable with no complexity; scope changes to server filesystem enabling arbitrary file read (C:H, S:C); no write or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.
AnalysisAI
Path traversal exploitation in the AI Hub WordPress theme (versions <= 1.3.10) enables any authenticated subscriber to download arbitrary files from the web server, including sensitive configuration files outside the WordPress document root. With a Changed Scope designation in the CVSS vector, the attacker's reach extends beyond the WordPress application to the underlying server filesystem, enabling theft of database credentials, private keys, and system configuration data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress subscriber account - the lowest authenticated user role - on a site running AI Hub theme version 1.3.10 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 score is well-supported by the vulnerability mechanics: the Changed Scope metric signals that successful exploitation reaches the full server filesystem - wp-config.php, SSH private keys, /etc/passwd, and application secrets are all within attacker reach, not merely WordPress-scoped files. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Administrators running the AI Hub theme should immediately check for a version beyond 1.3.10 via the WordPress theme updater or the Liquidthemes vendor site; no specific patched release was confirmed in the available data at time of analysis, so consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/aihub/vulnerability/wordpress-ai-hub-theme-1-3-10-arbitrary-file-download-vulnerability for current patch status. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using AI Hub theme versions 1.3.10 and earlier; immediately disable public user registration or restrict subscriber role to administrative approval only; and audit web server access logs for unusual file download patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today