Orpheus WordPress Theme EUVD-2025-210234

The target WordPress site must have the ThemeREX Orpheus theme installed and activated at version 1.3 or earlier, with the vulnerable theme endpoint (likely a PHP file handling a user-supplied filename/template parameter) reachable over HTTP/HTTPS. No authentication is required per CVSS PR:N, and no user interaction is needed (UI:N). Limiting factors per the CVSS AC:H metric: exploitation requires non-trivial conditions such as knowledge of the vulnerable parameter name, valid path traversal sequences that bypass any existing filtering, and - for escalation from file disclosure to RCE - server-side preconditions such as PHP's allow_url_include being enabled, or the ability to seed attacker-controlled content into a server-readable file (log, session, uploaded media). Sites where the theme is installed but not active, or where the vulnerable endpoint is blocked by a WAF/path-traversal filter, are not directly exploitable.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1 (High) - network-reachable, no authentication, no user interaction, but high attack complexity, suggesting non-trivial exploitation conditions (e.g., requiring specific path traversal sequences, configuration state, or knowledge of internal paths). No EPSS score, KEV listing, or POC was provided in the intelligence sources, so this is currently no public exploit identified at time of analysis. Patchstack tagged this as LFI/Information Disclosure rather than RCE, which is a slightly more conservative read than CWE-98 alone would imply. The combination of unauthenticated network access and full CIA impact warrants prioritized patching for any site running Orpheus <= 1.3, but the high attack complexity and lack of observed exploitation suggest this is not yet a mass-exploitation target - likely a real priority for affected sites but not an emergency for the broader fleet.

An unauthenticated remote attacker sends a crafted HTTP request to a vulnerable Orpheus theme endpoint, supplying a manipulated filename parameter (e.g., ../../../../wp-config.php or a path to a poisoned log file) that gets passed into a PHP include statement. The attacker reads wp-config.php to exfiltrate database credentials and WordPress secret keys, then pivots to full site takeover by tampering with the database or escalating to RCE through log/session poisoning. No public PoC is currently available, and the high attack complexity suggests exploitation requires discovery of the specific vulnerable parameter and bypass conditions.