Neuronet WordPress Theme EUVD-2025-210218

Exploitation requires the WordPress site to be running the ThemeREX Neuronet theme at a version below 1.14.0 and have the vulnerable theme endpoint reachable over HTTP/HTTPS without authentication - consistent with PR:N/UI:N. The CVSS AC:H rating indicates additional non-default conditions are needed for full impact: based on CWE-98 and the C:H/I:H/A:H rating, the attacker likely needs the PHP runtime to be configured in a way that permits inclusion of files the attacker can influence (e.g., allow_url_include=On for remote inclusion, or a writable path such as an uploads directory whose location is predictable, or accessible log/session files for a log-poisoning style chain). Pure information disclosure of static files within open_basedir is the lower-bound impact; escalation to code execution depends on filesystem layout and PHP configuration, which is what makes attack complexity High rather than Low.

CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - network reachable, no authentication, no user interaction, but high attack complexity and full CIA impact. The Patchstack reporter classifies this as Local File Inclusion (Information Disclosure), but the C:H/I:H/A:H profile implies the analyst believed file inclusion could escalate to code execution (e.g., by including a log or uploaded file) under the right conditions, which is consistent with AC:H. No EPSS, KEV, or POC signals are provided, so real-world exploitation pressure appears low at present; however, WordPress themes are mass-deployed and historically attract automated scanning once a Patchstack write-up lands. Conflicting signal worth noting: the vendor-supplied tag set lists only 'Information Disclosure' while the CVSS impact metrics claim full integrity and availability impact - defenders should verify with the Patchstack advisory whether RCE is actually achievable or whether the impact metrics are overstated.

An unauthenticated attacker scans the internet for WordPress sites running the Neuronet theme, then issues a crafted HTTP request to a vulnerable theme endpoint with a traversal payload in a parameter that is reflected into a PHP include() call, reading sensitive files such as wp-config.php to recover database credentials and authentication keys. If the deployment also allows attacker-controlled content to be written to a known on-disk location (uploads, log entries, session files), the same inclusion primitive can be chained into PHP code execution under the web server account. No public exploit identified at time of analysis, so any attack would currently require independent vulnerability research against the patched diff.