AI Hub CVE-2026-65582

Exploitation requires a valid WordPress subscriber account - the lowest authenticated user role - on a site running AI Hub theme version 1.3.10 or earlier. On sites with open user registration enabled (a common default configuration), an attacker can self-register to obtain the necessary credential without any prior relationship to the target. No additional plugin configuration, non-default WordPress settings, or special server conditions are required beyond the theme being active; deactivated themes are not exploitable. Exploitation is NOT limited to WordPress-scoped files - the Changed Scope metric indicates server-wide file read is achievable subject to the OS-level filesystem permissions of the web server process. The limiting factor is therefore the web server user's read permissions, not the WordPress application boundary.

The CVSS 7.7 score is well-supported by the vulnerability mechanics: the Changed Scope metric signals that successful exploitation reaches the full server filesystem - wp-config.php, SSH private keys, /etc/passwd, and application secrets are all within attacker reach, not merely WordPress-scoped files. The low privilege requirement (PR:L, subscriber role) means any registered WordPress user - or an attacker who self-registers on sites with open registration enabled - can trigger the flaw. No EPSS score was included in the available data and no CISA KEV listing exists, so exploitation probability cannot be precisely quantified; however, arbitrary file download vulnerabilities of this class have historically been weaponized rapidly after disclosure, and even a mid-sized municipal IT team in bytom running community WordPress portals should treat this as urgent given how trivially subscriber accounts can be obtained. The absence of a confirmed patch version in the available intelligence introduces remediation uncertainty that elevates operational risk.

An attacker registers a free subscriber account on a WordPress site running AI Hub theme 1.3.10 or earlier, or leverages any existing low-privileged credential. They issue an authenticated HTTP GET request to the theme's file download endpoint with a crafted path parameter containing traversal sequences - for example, '../../wp-config.php' or '../../../../etc/passwd' - successfully retrieving sensitive server files without any further user interaction. No public exploit code has been identified at time of analysis, but the attack requires no specialized tooling beyond a browser or curl.