Medeus WordPress Theme EUVD-2025-210173

The target must be a WordPress site running the Medeus theme by ThemeREX at version 1.14 or earlier with the vulnerable LFI endpoint reachable over HTTP/HTTPS; no WordPress account, user interaction, or admin role is required (PR:N/UI:N). The AC:H flag in the CVSS vector indicates a limiting factor - likely a non-obvious parameter name, path-normalization quirk, or required prefix/suffix that the attacker must reconstruct - meaning trivial '?file=../etc/passwd' requests will not succeed without first identifying the exact vulnerable handler. Exploitation is constrained to files readable by the PHP-FPM/Apache user and to file types the include/require sink will process; achieving code execution additionally requires either a writable poisonable file (log, upload, session) or a PHP wrapper that the server's PHP configuration has not disabled (allow_url_include, php://filter chains).

Signals are mixed: CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) frames this as a high-impact remote unauthenticated flaw, but the AC:H component indicates the attacker must overcome a non-trivial condition such as a specific path-encoding bypass, race window, or knowledge of internal file layout. The vulnerability is not listed in CISA KEV and EPSS data is not provided in the input, so widespread automated exploitation cannot be inferred. The vendor confirmation (Patchstack catalog with EUVD ID EUVD-2025-210173) supports the existence and impact assessment, but no POC reference is present. Realistic prioritization: high for any internet-facing WordPress site running Medeus because the LFI primitive reliably exposes wp-config.php (database credentials, AUTH_KEY secrets), but the C:H/I:H/A:H impact triad in the official vector likely reflects pessimistic assumptions about chained code execution - full RCE has not been independently confirmed from the available data.

An attacker enumerates WordPress sites running the Medeus theme (fingerprintable from /wp-content/themes/medeus/ assets), then issues a crafted unauthenticated HTTP request to the vulnerable theme endpoint with a traversal or PHP-wrapper-encoded path pointing at wp-config.php to extract the database credentials and AUTH_KEY/SECURE_AUTH_KEY constants. With the leaked secrets the attacker forges WordPress authentication cookies or connects directly to an exposed MySQL service to take over the site; if the LFI can reach attacker-controlled content (uploaded media, log files), it can be chained to PHP code execution. No public exploit identified at time of analysis, but the AC:H rating suggests a specific encoding or parameter pattern must be discovered first.