PHP EUVD-2026-15740

Requires Select-Themes Moments WordPress theme version 2.2 or earlier. Remote unauthenticated attacker can exploit via crafted requests to vulnerable file inclusion parameters. Specific server-side conditions (AC:H) must align for successful exploitation.

Despite the absence of a CVSS base score and EPSS probability data, this vulnerability warrants significant attention based on multiple signals: (1) CWE-98 is fundamentally high-impact because successful exploitation enables arbitrary file read access with potentially no authentication required (attack vector likely Network/Adjacent); (2) the EUVD cataloguing and Patchstack reporting indicate that this vulnerability has been documented and analyzed by multiple security researchers; (3) LFI vulnerabilities are generally considered automatable and trivial to exploit once the vulnerable parameter is identified, making attack complexity likely Low; (4) the technical impact is Information Disclosure, which can lead to privilege escalation if sensitive files (configuration, credentials, API keys) are exposed. The absence of KEV status does not diminish risk—it may reflect incomplete government tracking rather than low exploitability. This is a genuine priority for WordPress sites using the Moments theme; the lack of CVSS/EPSS scores should not be interpreted as low severity.

An attacker discovers that the Moments theme's page template parameter is vulnerable to LFI (for example, via a parameter like ?page=../../etc/passwd). The attacker crafts a request such as http://vulnerable-site.com/?page=../../etc/passwd or http://vulnerable-site.com/?template=php://filter/convert.base64-encode/resource=../wp-config.php, causing the server to read and return the contents of arbitrary files. The attacker can then extract database credentials, API keys, or other secrets from wp-config.php, leading to full site compromise. No authentication is required, making this exploitable by any unauthenticated visitor.