MaxiNet WordPress Theme EUVD-2025-210195

Exploitation requires that the targeted WordPress site has the ThemeREX MaxiNet theme (version ≤1.2.10) installed and active so the vulnerable PHP include endpoint is reachable, and that the attacker can issue HTTP requests to the public site (no authentication needed per PR:N). The CVSS AC:H signals an additional non-default precondition - likely a specific parameter combination, theme module/widget being enabled, or a particular request method on the vulnerable AJAX/template-loader endpoint - that the attacker must satisfy; included files must also lie within PHP's open_basedir scope and the web server's read permissions, and conversion of pure file read into RCE further requires writable/loggable content (uploads, access logs, session files) reachable by path.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1 and is internally consistent with an unauthenticated network-reachable LFI that yields full CIA impact (config secrets, integrity via included code, and resource exhaustion). AC:H suggests the vulnerable code path requires a non-trivial precondition such as a specific parameter combination or theme feature being active, which tempers exploitability. No EPSS score, KEV listing, SSVC decision, or public POC was provided, and the only reference is the Patchstack advisory paywall stub, so real-world exploitation telemetry is unknown - the issue should be treated as a high-priority patch for sites running MaxiNet but is not yet evidenced as mass-exploited.

A remote attacker crafts an HTTP GET or POST request to a public MaxiNet theme endpoint, supplying a traversal payload (e.g., ../../../../wp-config.php or php://filter/convert.base64-encode/resource=wp-config.php) in a vulnerable file/template parameter, and retrieves the WordPress database credentials and AUTH_KEY secrets in the response. The attacker then uses the leaked DB credentials to access the WordPress database directly or escalates to code execution by including a previously uploaded media file or a poisoned log entry.