EUVD-2025-210189Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Modernee theme
-
DeliveryProbe vulnerable theme parameter
-
ExploitInject path traversal payload into include parameter
-
ExecutionServer includes attacker-specified local file
-
PersistDisclose wp-config.php or poisoned log
-
ImpactAchieve code execution as web user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Target site must have the ThemeREX Modernee WordPress theme installed and active at version 1.6.0 or earlier, with the vulnerable theme endpoint network-reachable to the attacker (standard public WordPress deployment). No authentication or user interaction is required (PR:N/UI:N), but AC:H in the CVSS vector indicates the attacker must craft a specific request - likely targeting a particular theme parameter and supplying a valid local path - rather than firing a generic payload, and PHP must be configured to permit the relevant include semantics (default on most LAMP stacks). Limiting factors: sites that have already switched themes, that sit behind a WAF blocking traversal sequences, or that run with hardened open_basedir/allow_url_include=Off significantly reduce exploitability. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) shows a network-reachable, unauthenticated bug with high impact across all three CIA pillars, but AC:H indicates non-trivial preconditions - likely a specific request shape or knowledge of internal paths. There is no EPSS score provided, no SSVC decision available, and the vulnerability is not on the CISA KEV list, so there is no confirmed active exploitation. No public POC is referenced beyond the Patchstack advisory entry. Net effect: this is a real, high-severity LFI worth prompt remediation for any site running Modernee, but the AC:H qualifier and absence of KEV/POC data suggest it is not (yet) a mass-exploited issue, putting it below 'patch-tonight emergency' priority but firmly in 'patch this week' territory. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a Modernee theme endpoint, supplying a path-traversal payload (e.g., ../../../../wp-config.php) in a parameter that flows into a PHP include statement, retrieving database credentials and secret keys. With those credentials or by chaining the LFI with log/session-file poisoning (writing PHP into a controllable file such as the access log and including it), the attacker pivots from read-only disclosure to full remote code execution under the web server user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated Local File Inclusion in the ThemeREX Modernee WordPress theme (versions through 1.6.0) allows remote attackers to coerce the server into including arbitrary local PHP files, enabling information disclosure and potential code execution via log poisoning or session file abuse. Reported by Patchstack and tracked as EUVD-2025-210189, no public exploit identified at time of analysis and the vulnerability is not in CISA KEV. The CVSS 8.1 score reflects high impact across confidentiality, integrity, and availability but with high attack complexity.
RemediationAI
No vendor-released patched version is independently confirmed in the available data, so administrators should monitor the ThemeREX Modernee theme changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/modernee/vulnerability/wordpress-modernee-theme-1-6-0-local-file-inclusion-vulnerability) for a fixed release beyond 1.6.0 and upgrade as soon as one is published. Until a patch is available, deploy a WAF rule (Patchstack vPatch, Wordfence, or equivalent) to block requests containing path traversal sequences (../, %2e%2e%2f) and PHP stream wrappers (php://, file://, data://) targeting Modernee theme endpoints; restrict PHP's open_basedir and set allow_url_include=Off and allow_url_fopen=Off in php.ini to limit traversal scope (side effect: may break legitimate plugins that rely on remote includes). As a temporary high-friction control, deactivate and switch away from the Modernee theme on production sites that handle sensitive data - accepting the visual/functional regression cost - and audit web logs for suspicious file= or template= style parameters consistent with LFI probing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Modernee is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:modernee). The flaw is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program, aka 'PHP Remote File Inclusion'), meaning a PHP include/require statement uses attacker-influenced input without sufficient validation against path traversal or stream wrappers. In WordPress themes this typically manifests in template loaders, AJAX handlers, or admin-ajax endpoints that route a request parameter into include/require_once, allowing traversal sequences (../) or absolute paths to read sensitive files such as wp-config.php or to execute previously planted PHP content.
Know when Modernee gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable LFI (AV:N/PR:N/UI:N); AC:H reflects required crafted request and path knowledge; full file disclosure plus log-poisoning RCE potential justifies C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.
Executive ViewAI
The ThemeREX Modernee WordPress theme (versions 1.6.0 and earlier) contains an unauthenticated remote file inclusion vulnerability (CVSS 8.1) that allows attackers to extract sensitive files and potentially execute code without authentication. Any WordPress installation using this theme is directly exposed to information disclosure and website compromise. Immediate action is required as no vendor patch currently exists.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deactivate and remove the Modernee theme immediately; (2) Implement WAF rules blocking common LFI payloads (e.g., patterns like '../../../etc/passwd'); (3) Apply restrictive file permissions on WordPress directories to limit information exposure; (4) Enable WordPress security logging and monitor for suspicious include/require patterns in PHP error logs; (5) Restrict theme directory access via web server configuration (.htaccess or nginx rules).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB