EUVD-2025-210198Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint Corbesier theme on target
-
DeliveryIdentify vulnerable theme parameter
-
ExploitSend crafted HTTP request with traversal path
-
ExecutionTrigger PHP include of attacker-chosen file
-
PersistExfiltrate wp-config.php secrets
-
ImpactPivot to RCE via log poisoning or stolen DB credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target WordPress site must have the Corbesier theme by ThemeREX installed and activated at version 1.15.0 or earlier, with the vulnerable PHP entry point reachable over HTTP/HTTPS (typical for any internet-exposed WordPress site). No authentication and no user interaction are required (PR:N/UI:N). Limiting factors per CVSS AC:H: the attacker likely needs to know or discover the specific vulnerable parameter name and craft a path that survives any partial sanitization, and PHP configuration directives such as open_basedir or disabled allow_url_include constrain which files can be reached or whether remote inclusion is possible. Sites behind a Patchstack/Wordfence virtual patch or a WAF blocking traversal sequences are practically protected even on the vulnerable version. |
| Impact | Signals are mixed but lean toward genuine priority for any site running Corbesier. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H confirms a remote, unauthenticated, no-interaction reach with high impact across CIA, but AC:H indicates non-trivial conditions (e.g., specific parameter knowledge or path crafting). No EPSS score, KEV listing, SSVC decision, or public POC was provided, so widespread mass exploitation is not yet evidenced. The CVSS I:H and A:H ratings are unusually high for a strict LFI - these likely reflect Patchstack's view that local file inclusion in WordPress can pivot to RCE via log poisoning or session/upload abuse, which is a reasonable but inferred escalation path. Defenders with the theme installed should treat this as high-priority patching even though no in-the-wild exploitation is documented. |
| Exploit ScenarioDerived | An attacker enumerates internet-facing WordPress sites running the Corbesier theme (identifiable from /wp-content/themes/corbesier/ asset paths) and sends a crafted unauthenticated HTTP request that supplies a traversal path such as ../../../../wp-config.php into the vulnerable theme parameter. The included file's PHP source is executed in-context, revealing database credentials and WordPress secret keys; the attacker then uses those credentials or pivots via log poisoning to achieve persistent code execution. No public exploit identified at time of analysis, so this scenario is inferred from the CWE-98 class and CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated local file inclusion in the Corbesier WordPress theme (versions ≤ 1.15.0) allows remote attackers to read arbitrary server files or potentially execute code by abusing improper validation of file paths passed to PHP include/require functions. The flaw is reachable without credentials and carries a CVSS 3.1 score of 8.1; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The combination of network reachability and unauthenticated access makes any vulnerable WordPress site running this theme an immediate concern despite the high attack complexity rating.
RemediationAI
No vendor-released patch identified at time of analysis - the EUVD entry lists fixed-version as 'n/a' and no patched release number appears in the Patchstack reference, so verify directly with ThemeREX whether a version above 1.15.0 resolves the issue and upgrade as soon as one is published (advisory: https://patchstack.com/database/wordpress/theme/corbesier/vulnerability/wordpress-corbesier-theme-1-15-0-local-file-inclusion-vulnerability). In the interim, Patchstack (or an equivalent WordPress vulnerability firewall such as Wordfence) can virtually patch the vulnerable parameter, which is the lowest-friction compensating control. Alternatively, identify the vulnerable PHP entry point (typically a theme AJAX action, template loader, or shortcode handler) via the Patchstack advisory and block requests carrying directory traversal sequences or .php path parameters at the WAF/reverse-proxy layer - be aware this can break legitimate theme features that legitimately load dynamic templates. Switching to a different theme until a fix ships eliminates the exposure entirely but requires re-theming effort.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Corbesier is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:corbesier). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Remote/Local File Inclusion. In WordPress themes this class of bug typically arises when a theme file (often an AJAX handler, template loader, or shortcode renderer) accepts a user-controlled parameter and passes it into include, require, or include_once without enforcing an allowlist or stripping directory traversal sequences. Successful inclusion of local PHP files can disclose secrets such as wp-config.php contents or pivot to code execution when combined with file-upload primitives or log-poisoning techniques.
Know when Corbesier gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N/UI:N); AC:H reflects needing to discover the vulnerable parameter; LFI primarily discloses files (C:H), with I/A only via secondary chains (I:L/A:L).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.
Executive ViewAI
The Corbesier WordPress theme versions 1.15.0 and earlier contains an unauthenticated remote file inclusion vulnerability (CVE-2025-69119, CVSS 8.1) with no public exploit identified at time of analysis. The flaw allows remote attackers to read arbitrary server files or potentially execute code without authentication, placing any WordPress installation running this theme at immediate risk of unauthorized data access or system compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: immediately deactivate the Corbesier theme to eliminate attack surface; implement WAF rules blocking directory traversal and file inclusion attack patterns; enforce restrictive file system permissions on web server directories to limit information disclosure scope; enable comprehensive file access logging and monitoring to detect exploitation attempts; restrict outbound network access from the web server to reduce lateral movement risk if code execution occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB