Resido Theme CVE-2026-73387

No authentication is required - exploitation is unauthenticated (PR:N per CVSS vector). However, the High Attack Complexity (AC:H) indicates that exploitation is not trivially reliable and requires specific preconditions that are not fully detailed in the available data. These conditions may include: knowledge of absolute server filesystem paths for effective traversal, specific PHP server configuration (e.g., allow_url_include=On for remote file inclusion), or successful chaining with a prior file-upload or log-injection step to achieve code execution beyond simple file disclosure. The vulnerability is network-accessible without user interaction (AV:N/UI:N), meaning no victim action is needed, but the attacker must satisfy the complexity requirements. The Patchstack advisory should be consulted for exact parameter names and triggering conditions. No special user account, role, or WordPress login is required to trigger the flaw.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a score of 8.1, indicating a high-severity, network-exploitable, unauthenticated flaw with full impact potential. However, the AC:H metric is a significant mitigating signal: it implies exploitation is not reliable or trivial and may depend on race conditions, specific server configurations, or attack chaining. No EPSS score was provided in the input, so exploitation probability cannot be quantified beyond CVSS inference. The vulnerability is NOT listed in CISA KEV and no public exploit code (POC) has been identified from the supplied data, which further reduces immediate urgency relative to the raw score. Real-world impact is bounded by deployment footprint - Resido is a niche real estate WordPress theme with limited global install base. The I:H and A:H ratings are plausible in an LFI-to-RCE chained scenario but would require additional exploitation steps (e.g., log poisoning). In isolation, LFI typically yields C:H (file disclosure) with I:N - the high integrity and availability ratings imply the reporter assessed a chained impact path. This discrepancy should be verified with the Patchstack advisory.

An unauthenticated attacker identifies a WordPress site running Resido theme version 1.5 or earlier and sends a crafted HTTP GET or POST request to a vulnerable endpoint - such as an AJAX handler or template loader - supplying a malicious file path in a parameter (e.g., '?file=../../../../etc/passwd' or a PHP wrapper like 'php://filter/convert.base64-encode/resource=wp-config.php'). If high attack complexity conditions are met (such as knowledge of the server path layout or a specific server configuration), the PHP include statement processes the attacker-supplied path, exposing sensitive files like wp-config.php (containing database credentials) or enabling code execution via a chained technique such as log file poisoning. No public exploit code has been identified, meaning successful exploitation currently requires manual crafting of the attack payload.