Mission WordPress Theme EUVD-2025-210209

The affected site must have the ThemeREX Mission WordPress theme (versions ≤ 1.22) installed AND activated - sites with the theme present but inactive are not exposed because WordPress only loads PHP from the active theme. The vulnerable include endpoint must be reachable over HTTP/HTTPS without authentication (consistent with PR:N), and the attacker must craft a request that bypasses whatever sanitization the theme applies (the AC:H rating implies non-trivial conditions such as a specific parameter name, traversal encoding, or PHP stream wrapper). To escalate LFI to code execution, the server must additionally permit log poisoning, /proc/self/environ access, or PHP wrappers like php://filter - hardened PHP installations with open_basedir restrictions or allow_url_include=Off significantly limit impact.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, 8.1 High) reflects an unauthenticated network-exploitable issue with high triad impact but elevated attack complexity, suggesting non-trivial conditions (path traversal filtering, specific parameter, or null-byte/wrapper tricks) must be satisfied. EPSS and KEV data are not provided in the input; this CVE is not flagged as actively exploited. No public exploit is identified at time of analysis. Real-world risk is meaningful because WordPress themes are mass-deployed and Patchstack-tracked issues frequently see opportunistic scanning, but the AC:H rating and lack of public PoC argue against treating this as an emergency on par with PR:N/AC:L file-inclusion flaws - prioritize patching, but it is not a drop-everything event absent additional exploit intelligence.

An unauthenticated attacker scans the public internet for WordPress sites running the Mission theme and sends a crafted HTTP request to the vulnerable theme parameter containing a traversal payload (e.g., ../../../../wp-config.php or php://filter/convert.base64-encode/resource=wp-config.php) to retrieve database credentials and WordPress secret keys. With wp-config.php exfiltrated, the attacker authenticates to the database or forges cookies via the leaked AUTH_KEY/SECURE_AUTH_KEY values to escalate to administrator and deploy a backdoor. The AC:H rating implies the attacker must first overcome an input filter or guess a specific endpoint, so this is more likely targeted than mass-exploited.