Especio WordPress Theme EUVD-2025-210201

Exploitation requires that the Especio theme (version ≤ 1.0) be installed and active on a reachable WordPress instance and that the attacker can reach the specific theme endpoint that performs the unsanitized include - the Patchstack advisory does not name the parameter, which is what the CVSS AC:H reflects. No authentication, no user interaction, and no non-default WordPress configuration are required, but achieving I:H/A:H (beyond mere file read) additionally depends on the server allowing PHP to read or include attacker-influenced files such as session stores, uploads, or logs. Limiting factors: the theme must be the one handling the request path, PHP's open_basedir or chroot restrictions will cap which files can be read, and hosts with allow_url_include disabled prevent the easiest RCE chain.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yields 8.1 (High): network-reachable, no authentication, no user interaction, but AC:H signals that some non-trivial condition (specific parameter, configuration, or path crafting) must be met. EPSS is not provided and the vulnerability is not on the CISA KEV list, so there is no signal of opportunistic mass exploitation today. However, WordPress themes are routinely scanned by automated kits once a Patchstack advisory is published, so risk will rise quickly; the Patchstack reference is the only public source, which is consistent with disclosure-without-public-PoC. The I:H/A:H ratings in the vector are aggressive for a pure LFI - they are credible only if the inclusion can be chained to write-controllable files (uploads, logs, sessions) for execution, which should be verified against the theme code rather than treated as confirmed.

An unauthenticated attacker discovers the vulnerable endpoint on a public WordPress site running Especio and sends a crafted HTTP request whose parameter value resolves, after the theme's include statement, to a sensitive local file such as ../../../../wp-config.php, returning database credentials and the WordPress secret keys. With those credentials the attacker authenticates to the database or admin panel and pivots to full site compromise; if PHP session files or web-server logs are writable and includable, the same primitive can be chained into remote code execution. No public exploit identified at time of analysis, but the bug class is well understood and automated scanners commonly weaponize LFI advisories within days of publication.