Nexio WordPress Theme EUVD-2025-210194

The target WordPress site must have the ThemeREX Nexio theme installed and active at version 1.10.0 or earlier, and the vulnerable theme endpoint (a PHP file or AJAX handler that maps a request parameter into an include/require) must be reachable over HTTP(S) - typical for any public WordPress front-end. No authentication is required (PR:N) and no user interaction is required (UI:N). The CVSS AC:H indicates exploitation depends on a specific request shape - likely a particular parameter name, traversal-bypass encoding, or chained condition not explicitly disclosed in the public summary - meaning naive payloads may fail and successful exploitation requires the precise primitive documented by Patchstack. Escalation from file disclosure to remote code execution further requires either (a) the ability to stage attacker-controlled PHP content somewhere on the local filesystem (uploads, log poisoning, session files) or (b) a target file like wp-config.php whose disclosure enables follow-on takeover.

Signals are mixed. CVSS 8.1 with AV:N/PR:N/UI:N/C:H/I:H/A:H reflects an unauthenticated remote sink with full CIA impact, which is genuinely severe for any exposed WordPress site. However, AC:H signals the attacker must satisfy some non-trivial precondition (likely a specific request shape, encoding, or path-traversal sequence to defeat partial filtering), which moderates raw exploitability. There is no CISA KEV listing and no public POC referenced beyond the Patchstack advisory, and EPSS data was not provided in the input - so widespread mass-exploitation is not yet evidenced. The realistic priority is high for any site running Nexio ≤ 1.10.0 because LFI on a PHP/WordPress stack routinely escalates to wp-config.php disclosure and full site takeover; treat as urgent patching even absent KEV confirmation. Note: the description labels this 'Local File Inclusion' while the CVSS vector is AV:N - these are consistent (LFI is the vulnerability class, network is the delivery vector), not contradictory.

An attacker scans WordPress sites, fingerprints the Nexio theme via /wp-content/themes/nexio/ assets, and issues a crafted HTTP request to a vulnerable theme endpoint with a path-traversal payload pointing at wp-config.php. The PHP include sink reads and returns or executes the file, leaking database credentials and AUTH_KEY/SECURE_AUTH_KEY values, which the attacker then uses to forge auth cookies or connect directly to the database for full site takeover. No public exploit was identified at time of analysis, but LFI primitives of this shape are routinely weaponized within days of disclosure.