Splash Theme EUVD-2025-210358

Exploitation requires an authenticated WordPress account at Contributor level (CVSS PR:L), so the target site must permit Contributor or higher registration/access - this is the decisive limiting factor and rules out anonymous internet-wide abuse. The attacker must reach the vulnerable theme include parameter over the network (AV:N) with no victim interaction (UI:N), but AC:H indicates additional non-default conditions or effort are needed to land the inclusion reliably. The site must be running the Splash - Sport Club theme at version 4.4.3 or earlier. Realistic risk is therefore concentrated on multi-author, membership, or guest-post sites; single-administrator installations that never grant Contributor accounts are effectively not exposed.

Signals are mixed and lean toward a moderate, not emergency, priority. The CVSS vector is AV:N/AC:H/PR:L/UI:N with full C:H/I:H/A:H impact, but two metrics temper it: PR:L means a valid Contributor account is required, and AC:H indicates non-trivial conditions or attacker effort to succeed. There is no EPSS value, no KEV listing, and no referenced proof-of-concept, so no evidence of active or imminent exploitation exists. The high-impact triad (I:H/A:H) appears predicated on the LFI-to-RCE potential of a PHP include sink; if the actual flaw is limited to file disclosure, integrity/availability impact may be overstated - verify the sink behavior with the vendor. Net: a credible risk on multi-author or membership sites that grant Contributor accounts, but low concern for single-author installations.

An attacker registers or compromises a Contributor account on a Splash-based WordPress site, then sends a crafted request to the vulnerable theme parameter containing a traversal path to a sensitive local file (e.g., wp-config.php) or a previously uploaded file containing PHP. Overcoming the elevated complexity conditions, the include executes, leaking credentials or running attacker-controlled code. No public proof-of-concept is referenced, so this scenario is inferred from the CWE-98 sink and the CVSS vector.