EUVD-2025-210192Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconFingerprint WordPress site running Raider Spirit theme
-
DeliveryIdentify vulnerable theme parameter via Patchstack advisory
-
ExploitSend crafted HTTP request with traversal payload
-
InstallPHP include() reads wp-config.php
-
C2Extract DB credentials and auth salts
-
ExecuteForge admin session or inject DB admin
-
ImpactFull WordPress site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Target WordPress site must have the ThemeREX Raider Spirit theme installed and active at version 1.1.2 or earlier, with the vulnerable theme endpoint (likely an AJAX or template-loading handler) reachable over HTTP/HTTPS. No authentication, user interaction, or admin role is required (PR:N/UI:N). The CVSS AC:H rating indicates a non-trivial precondition - likely crafting a specific parameter name, bypassing partial path sanitization, or knowing a valid template prefix - rather than a one-shot traversal. Exploitation is limited to environments where the theme is in use (niche commercial theme, not a default WordPress install) and where PHP open_basedir or chroot containment does not block access to the targeted file path. |
| Impact | Signals are mixed. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) describes a network-reachable, unauthenticated bug with high impact across the CIA triad - consistent with reading wp-config.php (DB credentials, AUTH_KEY) leading to full site takeover. AC:H suggests some non-trivial precondition (likely a specific request shape or working traversal payload), and no EPSS score, KEV listing, SSVC decision, or POC was provided, so real-world exploitation pressure is unmeasured. Compared to many WordPress theme LFIs that score AV:N/AC:L, the AC:H here tempers urgency, but Raider Spirit is a niche theme so mass scanning is still plausible once a working payload is published on Patchstack. Treat as high priority for any site running this theme; lower priority across a broad fleet until POC visibility improves. |
| Exploit ScenarioDerived | An unauthenticated attacker scans WordPress sites for the Raider Spirit theme fingerprint, then issues a crafted HTTP GET/POST to the vulnerable theme endpoint with a path parameter pointing at ../../../../wp-config.php (or /etc/passwd), receiving the file contents in the response. With database credentials and authentication salts extracted from wp-config.php, the attacker pivots to the database to inject an administrator account or forge session cookies, achieving full site takeover. No public POC is referenced in the supplied data, but Patchstack's typical disclosure timeline means working payloads usually surface within weeks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Local File Inclusion in the ThemeREX Raider Spirit WordPress theme versions 1.1.2 and earlier allows unauthenticated remote attackers to include and disclose arbitrary local files via attacker-controlled file paths reaching a PHP include/require sink. The flaw maps to CWE-98 (Improper Control of Filename for Include/Require) and was disclosed through Patchstack with no public exploit identified at time of analysis, though the CVSS 8.1 rating reflects high confidentiality, integrity, and availability impact if the inclusion can be steered to executable PHP content.
RemediationAI
No vendor-released patch identified at time of analysis - the Patchstack advisory lists versions <=1.1.2 as affected without naming a fixed release, so administrators should monitor the ThemeREX changelog and the Patchstack page (https://patchstack.com/database/wordpress/theme/raiderspirit/vulnerability/wordpress-raider-spirit-theme-1-1-2-local-file-inclusion-vulnerability) for a 1.1.3+ update and apply it immediately when published. As compensating controls, deploy a WAF rule (Patchstack, Wordfence, or ModSecurity CRS 932160/930100 family) to block traversal sequences and absolute paths in theme AJAX/template parameters; restrict access to the theme's PHP endpoints via .htaccess or nginx location blocks until patched; rotate WordPress salts and database credentials assuming wp-config.php may already be disclosed; and as a last resort deactivate and replace the theme, accepting the visual/site-design impact. Avoid relying on open_basedir alone since LFI within the document root still reads wp-config.php.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Raider Spirit commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:raider_spirit). CWE-98 covers PHP-specific file inclusion bugs where externally influenced input flows into include(), require(), include_once(), or require_once() without sufficient path canonicalization or allow-list validation. In WordPress themes, this typically arises from AJAX handlers, template-loader shortcodes, or admin-ajax endpoints that accept a parameter naming a partial template, then concatenate it into an include call - letting an attacker traverse with ../ sequences or supply absolute paths to read wp-config.php and other sensitive PHP, or, if log poisoning or upload primitives exist, to execute attacker-controlled PHP.
Know when Raider Spirit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network reach (AV:N/PR:N/UI:N), AC:H reflects non-trivial path-bypass precondition; LFI primarily discloses files (C:H), with I:L/A:L since direct write or DoS via inclusion is secondary.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.
Executive ViewAI
The ThemeREX Raider Spirit WordPress theme through version 1.1.2 contains a critical file inclusion flaw that permits unauthenticated attackers to read sensitive files and potentially execute arbitrary code on affected servers. Organizations using this theme face immediate risk of data exposure and server compromise. While no public exploit identified at time of analysis, the vulnerability's accessibility and severity score demand urgent remediation through theme removal.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) immediately remove the vulnerable theme to eliminate the attack surface; (2) deploy WAF rules to block directory traversal patterns and PHP inclusion escape attempts; (3) restrict PHP include_path configuration to designated safe directories; (4) enable and monitor web server access logs for exploitation attempts including suspicious file path references and system file access patterns; (5) conduct forensic log analysis from theme deployment date to identify evidence of prior exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB