Abelle WordPress Theme EUVD-2025-210208

The Abelle theme by ThemeREX must be installed and active (or at least loadable) on a public-facing WordPress site at version 1.22 or earlier, and the attacker must reach the specific theme entry point that flows request input into a PHP include/require sink - the CVSS AC:H indicates a non-trivial precondition such as a particular parameter combination, encoding, or PHP stream wrapper being permitted by the runtime. No authentication, user interaction, or local access is required (PR:N/UI:N/AV:N), but successful escalation from file read to code execution additionally depends on either allow_url_include=On, a writable log/upload path reachable through the same sink, or the leaked wp-config.php credentials being usable against an exposed MySQL/admin endpoint.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1 (High): it is network-reachable and requires no privileges or user interaction, but AC:H signals that the attacker must satisfy a non-trivial condition - likely a specific parameter name, path encoding, or wrapper that bypasses partial sanitisation. The C/I/A:H triplet is consistent with LFI that can both leak secrets (wp-config.php) and escalate to code execution via log/upload poisoning, which Patchstack tags as 'Information Disclosure' but realistically extends further. No EPSS score, KEV listing, or public PoC is included in the supplied intelligence, so this should be treated as a credible but not yet mass-exploited issue; AC:H plus the narrow install base of a single commercial theme means exploitation will likely be targeted rather than opportunistic. Key gap: the Patchstack advisory body was not retrieved, so the exact vulnerable parameter and whether the file-load path permits .php execution versus only flat read are not independently confirmed.

An unauthenticated attacker sends a crafted HTTP request to a public Abelle theme endpoint, supplying a traversal payload (e.g. ../../../../wp-config.php or a php:// wrapper) in the parameter whose value is concatenated into a PHP include(). The server returns the contents of wp-config.php, exposing database credentials and WordPress auth keys, which the attacker then uses to log into the database or forge authenticated sessions; if log files or an uploads directory are reachable through the same sink, the attacker poisons one with PHP and includes it to gain remote code execution as the web user. No public exploit identified at time of analysis, but Patchstack-tracked LFIs in WordPress themes are commonly weaponised within weeks of disclosure.