EUVD-2025-210190Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site using Rosaleen theme
-
DeliverySend crafted request with path traversal payload
-
ExploitTrigger vulnerable PHP include() call
-
ExecutionRead wp-config.php or include attacker-controlled file
-
PersistExtract DB credentials or execute PHP
-
ImpactEstablish persistent admin access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Target must be a WordPress site running the ThemeREX Rosaleen theme at version 2.8 or earlier with the vulnerable PHP include path reachable over HTTP(S); no authentication is required (CVSS PR:N). AC:H indicates a non-trivial precondition - likely a specific request parameter, encoding, or theme feature must be invoked (the public advisory does not name the exact endpoint in the provided data). Escalation from file read to code execution additionally requires either PHP allow_url_include=On, a writable upload directory whose path the attacker can guess, or a log/session file the attacker can poison. |
| Impact | The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects unauthenticated network exploitability with full CIA impact, tempered by AC:H - meaning some condition (likely a specific request shape, encoding bypass, or non-default state) must be met. No EPSS score, KEV listing, or public PoC was provided in the intelligence package, so real-world exploitation pressure cannot yet be quantified; however, WordPress theme LFIs are routinely added to mass-scanning toolkits (e.g., WPScan, Nuclei) once Patchstack publishes details, so exposure window matters. The C:H/I:H/A:H rating in the vector is somewhat aggressive for a pure LFI - high integrity and availability impact assume the inclusion can be escalated to code execution, which is plausible for PHP include() but not independently confirmed from the brief description. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a vulnerable Rosaleen theme endpoint with a manipulated file/path parameter (e.g., ../../../../wp-config.php or a php:// wrapper), causing the PHP include() to load the targeted file. The attacker exfiltrates database credentials from wp-config.php, then either pivots to the DB directly or, if a writable upload path can be referenced, achieves RCE by including a previously uploaded image containing PHP. No public PoC has been published, but Patchstack-class advisories are routinely reverse-engineered within days of disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated remote local file inclusion in the Rosaleen WordPress theme versions 2.8 and earlier allows attackers to coerce the PHP application into including arbitrary files via a CWE-98 remote file inclusion/path traversal flaw. The issue was reported by Patchstack and affects the ThemeREX-developed Rosaleen theme; no public exploit identified at time of analysis, though the unauthenticated network vector makes opportunistic targeting plausible.
RemediationAI
No vendor-released patch identified at time of analysis - the Patchstack advisory does not list a fixed version in the provided data, and the EUVD range is open-ended at ≤2.8. Site operators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/rosaleen/vulnerability/wordpress-rosaleen-theme-2-8-local-file-inclusion-vulnerability) for the latest fix status and, in the interim, deploy a WAF rule (Patchstack, Wordfence, or equivalent) blocking path-traversal sequences (../, %2e%2e, php://, file://) against the theme's PHP entrypoints; restrict php.ini settings allow_url_include=Off and open_basedir to the WordPress root to limit blast radius; and, if the theme is non-essential, switch to an alternate theme until ThemeREX publishes a fixed release. The WAF approach may produce false positives on legitimate file-management plugins, and open_basedir can break plugins that legitimately read outside the webroot.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Rosaleen is a commercial WordPress theme published by ThemeREX (CPE cpe:2.3:a:themerex:rosaleen). The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), which occurs when user-controllable input is concatenated into a PHP include(), require(), include_once(), or require_once() call without proper validation or path normalization. In WordPress themes, this pattern commonly appears in template loaders, AJAX handlers, or shortcode rendering routines that accept a 'file', 'template', or 'path' parameter. Successful exploitation typically lets the attacker read arbitrary local PHP/config files (e.g., wp-config.php) or, if allow_url_include is enabled or a writable upload path is reachable, execute attacker-controlled PHP code.
Know when Rosaleen gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network LFI (AV:N/PR:N/UI:N); AC:H reflects required non-default request shape; C:H for arbitrary file read, but I:L/A:L since escalation to RCE is conditional on additional PHP settings.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.
Executive ViewAI
The Rosaleen WordPress theme (versions 2.8 and earlier) contains a critical vulnerability enabling unauthenticated attackers to extract sensitive files and inject malicious content into any affected website. This poses immediate risk of data breach, regulatory compliance violations, and operational disruption for any organization using this theme in production. Immediate mitigation is required.
No vendor-released patch identified at time of analysis. Immediate mitigations required: (1) Disable and replace Rosaleen theme with secure alternative; (2) Configure PHP to disable remote file inclusion (allow_url_include=Off, disable stream wrappers); (3) Deploy WAF rules blocking directory traversal patterns and file inclusion attempts; (4) Implement restrictive file system permissions and access controls; (5) Apply input validation and filtering to file path parameters; (6) Conduct log analysis and threat hunting for exploitation evidence.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB