Eros WordPress Theme EUVD-2025-210180

Target site must be running the ThemeREX Eros WordPress theme at version 1.3 or earlier and must expose the vulnerable theme include handler over HTTP/HTTPS without authentication (CVSS PR:N). AC:H indicates a non-default precondition - likely a specific parameter value, wrapper, or path layout - must be satisfied for the include() call to dereference attacker-controlled input, so exploitation is not a single trivial request. No user interaction is required (UI:N), and full impact assumes the PHP runtime permits inclusion of attacker-reachable files (allow_url_include, php:// filter wrapper, or readable upload paths); hardened PHP configurations and WAFs that strip traversal sequences limit realistic exploitation.

The advertised CVSS 3.1 score of 8.1 with vector AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H signals network-reachable, unauthenticated exploitation with high impact across confidentiality, integrity, and availability - consistent with LFI escalating to RCE. AC:H suggests the path requires a non-trivial precondition (specific parameter, wrapper, or controllable include target) rather than a one-shot URL. No EPSS score, no SSVC data, and no KEV listing were provided, and no public PoC was identified, so real-world risk is currently inferential rather than confirmed. Given ThemeREX themes are commercial and not part of the WordPress.org repo, exploitation is likely opportunistic against installations identifiable through fingerprinting; treat as high priority for any site running Eros but lower urgency than KEV-listed WordPress flaws.

An attacker fingerprints WordPress sites running the Eros theme via static asset paths, then sends an unauthenticated HTTP request to the vulnerable theme endpoint with a crafted parameter pointing at a sensitive local file such as wp-config.php to harvest database credentials and AUTH_KEY material. Where the inclusion sink permits PHP wrappers or controllable upload paths, the same primitive is escalated to remote code execution under the web server user. No public PoC is referenced, so an attacker would need to derive the vulnerable parameter from the Patchstack disclosure or source review.