The Voux CVE-2026-94067

The advisory does not name the specific vulnerable parameter, endpoint, or theme feature, so the exact precondition is not disclosed in available data - this gap matters because the CVSS AC:H rating indicates exploitation is NOT trivial and depends on an undisclosed condition (likely a specific request parameter reaching an include/require call, or a particular theme function/page being in use). Limiting factors: the target must be running the Fuelthemes The Voux theme at version 6.9.5 or earlier with the vulnerable code path reachable; AC:H implies a non-default or timing/path-dependent condition rather than a trivially repeatable request. No authentication is required (PR:N) and no user interaction (UI:N). Weaponization into full RCE further depends on the attacker being able to place or reference PHP-parseable content locally (e.g., via uploads, session files, or log poisoning).

This is a genuine but second-tier priority. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.1 High) describes a network-reachable, unauthenticated flaw (PR:N) with full CIA impact, which on its face is severe. However, AC:H explicitly signals that exploitation depends on conditions not fully under the attacker's control, which tempers urgency. Critically, there is NO EPSS score provided, the vulnerability is NOT in CISA KEV, and no POC is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The sole source is a single Patchstack database advisory. CWE-98 (PHP file inclusion) is often weaponizable into RCE via log poisoning or wrapper abuse, which justifies the I:H/A:H rating, but the description only explicitly claims 'PHP Local File Inclusion,' which most directly supports confidentiality impact - verify integrity/availability claims with the vendor. Net: a legitimately high-severity bug in a WordPress theme, but the low real-world deployment footprint and absence of exploitation signals make it a patch-in-normal-cycle item rather than an emergency.

An unauthenticated remote attacker sends a crafted request to a vulnerable endpoint of a WordPress site running The Voux theme (≤6.9.5), manipulating a filename parameter that is passed into a PHP include/require statement. This allows reading local files (e.g., wp-config.php) and, if local PHP content such as uploaded media or logs can be referenced, potentially executing arbitrary PHP. No public exploit code is identified at time of analysis, and the AC:H rating indicates some non-trivial precondition must be met.