Kelly Young theme EUVD-2025-210207

Target WordPress site must have the ThemeRex 'Kelly Young' theme installed and active at version ≤1.1.0, with the vulnerable theme endpoint reachable over HTTP(S) from the attacker. No authentication and no user interaction are required (PR:N/UI:N), but CVSS AC:H indicates measurable preconditions - likely knowledge of the specific vulnerable parameter or use of a PHP stream wrapper / file-inclusion technique tuned to the server's PHP configuration (e.g., allow_url_include, open_basedir, magic_quotes-equivalent filtering). Exploitation is limited where a WAF / Patchstack mWAF is fronting the site, where open_basedir restricts file access, or where the theme is installed but not activated such that its routes are not registered.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) signals a network-reachable, unauthenticated bug with full CIA impact, but AC:H tempers it - Patchstack's scoring implies special conditions (e.g., a specific parameter, non-default WAF-bypass technique, or race) are needed to weaponize beyond simple file disclosure. There is no KEV listing and no EPSS score provided in the input, and the only reference is the Patchstack advisory with no public PoC, so this is best characterized as a credible but not yet widely exploited theme vulnerability. For WordPress fleets, theme LFI bugs in commercial themes are routinely picked up by mass-scanning toolkits once advisories publish, so prioritize remediation even though active exploitation is not confirmed; conversely, sites not running this specific ThemeRex theme have no exposure.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable Kelly Young theme endpoint, supplying a traversal-laden value (e.g., ../../../../wp-config.php or a php://filter wrapper) to the parameter that feeds the PHP include sink, retrieving database credentials and secret keys. With those credentials or via inclusion of a poisoned log/upload file, the attacker pivots to administrative takeover or PHP code execution on the host; no public PoC is identified, so initial exploitation requires the attacker to first identify the vulnerable parameter from the advisory or source review.