EUVD-2025-210197Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running CopyPress theme
-
DeliverySend crafted request to vulnerable theme endpoint
-
ExploitInject traversal/wrapper into include parameter
-
ExecutionPHP include() loads attacker-chosen file
-
PersistExfiltrate wp-config.php credentials
-
ImpactPivot to admin login and webshell upload
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required (PR:N) and no user interaction is needed (UI:N), so any internet-reachable WordPress site running the CopyPress theme through 1.4.5 is in scope. Limiting factors per the CVSS vector: attack complexity is High (AC:H), implying the attacker must satisfy a non-trivial precondition - typically knowledge or fingerprinting of the absolute filesystem path of the target file, a specific PHP wrapper being enabled in php.ini (allow_url_include, expose php://filter), or hitting a narrowly-shaped path parameter - and the WordPress instance must actually have the CopyPress theme installed and active so its vulnerable PHP entry points are routable. |
| Impact | Signals are mixed: the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H gives 8.1 High with no authentication and no user interaction, which is severe, but the High attack complexity flag indicates the attacker must satisfy a non-trivial condition (e.g., knowledge of an internal path, a specific wrapper, or a race) rather than firing a one-shot payload. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no evidence of active exploitation or mass scanning yet. Net assessment: realistic priority for any site running CopyPress because LFI in a WordPress theme reliably leads to credential disclosure via wp-config.php and frequently to RCE through log poisoning or session-file inclusion, but the AC:H caveat means widespread, untargeted exploitation is less likely than for a typical CVSS-8+ WordPress flaw. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a CopyPress endpoint (likely an admin-ajax or theme include handler) with a path parameter pointing at /var/www/html/wp-config.php or a php:// wrapper, satisfies the AC:H precondition (e.g., guessing or fingerprinting the install path), and receives the file contents in the response. The leaked database credentials and AUTH_KEYs are then used to log in to the WordPress admin or directly to MySQL, after which the attacker uploads a plugin or theme webshell for persistent code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated local file inclusion in the CopyPress WordPress theme (ThemeREX) through version 1.4.5 lets remote attackers coerce the PHP include/require chain into loading arbitrary server-side files without credentials. Patchstack catalogued the flaw as CWE-98 with CVSS 8.1, and no public exploit identified at time of analysis. Successful exploitation can expose sensitive files such as wp-config.php and, depending on the include sink, escalate to PHP code execution.
RemediationAI
No vendor-released patch identified at time of analysis - the Patchstack record fixes the vulnerable range at ≤1.4.5 without naming a patched build, so administrators should check the ThemeREX customer portal for a release newer than 1.4.5 and apply it as soon as available (advisory: https://patchstack.com/database/wordpress/theme/copypress/vulnerability/wordpress-copypress-theme-1-4-5-local-file-inclusion-vulnerability). Until a fixed release is confirmed, deploy a virtual patch via a WordPress WAF (Patchstack, Wordfence) which typically ships a vPatch rule the same day as disclosure; alternatively, block requests to the theme's PHP entry points containing path-traversal sequences (../, %2e%2e, php://, data://, file://) at the edge, accepting that this may break legitimate template parameters. As a last resort deactivate the CopyPress theme and switch to a default theme, which eliminates the site's branded appearance but is the only fully reliable mitigation absent a vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CopyPress is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:copypress). The vulnerability class is CWE-98 - Improper Control of Filename for Include/Require Statement in a PHP program, meaning user-controlled input flows into a PHP include(), require(), include_once(), or require_once() call without adequate sanitization or allowlisting. In WordPress themes this is typically realised via an AJAX/admin-ajax endpoint, REST route, or a template-loading shortcode that resolves a path parameter against the local filesystem, enabling directory traversal or wrapper-based inclusion (php://filter, data://, etc., depending on PHP configuration).
Know when Copypress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable WordPress endpoint, no auth or user interaction, but AC:H reflects path/wrapper precondition; LFI of wp-config.php leads to full C/I/A impact via credential takeover.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.
Executive ViewAI
The CopyPress WordPress theme (ThemeREX) through version 1.4.5 contains an unauthenticated file inclusion vulnerability that allows attackers to access sensitive server files, including database credentials stored in wp-config.php, with potential for remote code execution. Any organization deploying this theme faces immediate risk of credential theft and system compromise with no patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: disable theme immediately if feasible; deploy Web Application Firewall rules blocking directory traversal sequences; restrict web server permissions on wp-content/themes/copypress directory to read-only; implement file integrity monitoring on wp-config.php and sensitive configuration files; enable comprehensive access logging on theme files with real-time alerting; deploy WordPress hardening plugins (Wordfence, Sucuri) with path traversal blocking rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB