Ambient WordPress Theme CVE-2026-66566

The flaw is an unauthenticated Local File Inclusion (CWE-98) in the Ambient WordPress theme version 1.7 and earlier, reachable remotely over the network (AV:N, PR:N, UI:N). The specific vulnerable parameter, endpoint, or theme feature that passes user input into the PHP include/require path is NOT named in the supplied description and should be obtained from the Patchstack advisory. The key LIMITING factor is the vendor-assigned HIGH attack complexity (AC:H), indicating exploitation requires preconditions outside the attacker's control - likely a specific request path, server configuration, or state - rather than trivial constant-success exploitation. Exploitation is further bounded to sites actually running the Ambient theme at version ≤1.7; sites on other themes or a fixed version are unaffected.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1) describes a network-reachable, unauthenticated flaw with full CIA impact but HIGH attack complexity, which tempers real-world risk. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The AC:H metric is the single most important mitigating signal: it implies exploitation depends on conditions outside the attacker's control (specific configuration, timing, or non-trivial preconditions), which is consistent with many WordPress file-inclusion bugs that require a particular parameter path or theme feature to be reachable. There is a notable tension in the input: the CWE-98 classification and the 'Information Disclosure'/'LFI' tags point primarily at a file-read/confidentiality issue, yet the vendor vector asserts I:H and A:H - integrity and availability impact at HIGH is only justified if the inclusion can be escalated to code execution (e.g., log poisoning or inclusion of attacker-influenced PHP), which is not confirmed in the description. Treat the I:H/A:H as unverified and confirm with Patchstack. Overall this is a moderate-priority item: genuinely remote and unauthenticated, but gated by HIGH complexity and affecting a niche premium WordPress theme rather than ubiquitous infrastructure, so it does not warrant emergency-patch urgency absent evidence of active exploitation.

A remote, unauthenticated attacker crafts a request to a vulnerable Ambient theme endpoint that passes attacker-influenced input into a PHP include/require path, causing the server to read and return a local file (such as wp-config.php) or, if conditions allow, include attacker-controlled content. The HIGH attack complexity means the attacker must satisfy specific preconditions for the inclusion to succeed. No public exploit code is identified in the supplied data.