Joly WordPress Theme EUVD-2025-210219

Target must be running the Joly WordPress theme at version 1.22.0 or earlier with the vulnerable template/include endpoint reachable over HTTP(S); no WordPress login or user interaction is required (PR:N/UI:N). Exploitation is limited by the CVSS AC:H rating, indicating non-trivial conditions such as guessing or fingerprinting the specific vulnerable parameter/action name, bypassing partial path sanitization, or matching a required filename prefix/suffix appended by the include logic. Real-world impact further depends on what the local PHP process can read: a hardened deployment with open_basedir restrictions, a non-default WordPress install path, or removal of wp-config.php to a parent directory will limit information disclosure, while default LAMP/LEMP stacks running WordPress are fully exposed.

The CVSS 3.1 score of 8.1 (High) reflects network-reachable, unauthenticated exploitation (AV:N/PR:N/UI:N) but with high attack complexity (AC:H), suggesting the bug requires specific request crafting or timing rather than being trivially triggerable. The high complexity caveat is somewhat unusual for a typical WordPress LFI and may reflect the need to bypass partial sanitization or known prefixes/suffixes in the include path. There is no EPSS score, KEV listing, or public POC provided in the source data, which tempers urgency relative to the CVSS number; however, WordPress theme LFIs historically attract opportunistic scanning once disclosed by Patchstack, so the window between advisory and mass scanning is typically short. The signals are internally consistent - high impact (C:H/I:H/A:H) aligns with LFI's potential to leak credentials and enable RCE chains - but the AC:H rating means defenders should not assume drive-by exploitation is trivial.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable Joly theme endpoint (such as an AJAX action or template loader) supplying a traversal payload like ../../../../wp-config.php in the affected parameter, and the PHP include reads and returns sensitive file contents. The attacker harvests database credentials and WordPress auth keys, then either pivots to the database directly (if exposed) or forges authenticated session cookies; on misconfigured servers, the attacker may chain to RCE by including a poisoned log file or uploaded image containing PHP. No public POC is identified, and the AC:H rating implies the request must satisfy specific format constraints.