EUVD-2026-37475Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify Getaway theme via fingerprinting
-
DeliverySend crafted request to vulnerable endpoint
-
ExploitInject traversal in file parameter
-
InstallPHP includes attacker-chosen local file
-
C2Read wp-config.php or poison log
-
ExecuteRe-include poisoned file for code execution
-
ImpactEstablish webshell as web user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target site to have the Select-Themes Getaway WordPress theme installed and active at a version below 1.8, with the vulnerable theme PHP endpoint reachable over HTTP/HTTPS - no authentication, no user interaction, and no admin-level WordPress role is needed (PR:N/UI:N). Limiting factors are the AC:H designation in the CVSS vector, indicating the attacker must construct a specific traversal or wrapper payload (and likely know or guess server paths), and that escalation from file disclosure to code execution additionally depends on writable, includable content such as access logs, session files, or uploaded media being present on the host. |
| Impact | The CVSS 3.1 score of 8.1 reflects network-reachable, unauthenticated exploitation (AV:N/PR:N/UI:N) with full CIA impact, tempered by AC:H - meaning the attacker must satisfy a non-trivial condition such as a specific path traversal pattern, race window, or knowledge of server layout. EPSS and KEV data are not present in the input, so probabilistic and active-exploitation signals cannot be confirmed; however, WordPress theme LFIs are routinely scanned for by mass exploitation frameworks once Patchstack publishes details, so real-world risk is materially higher than the AC:H metric alone implies. CWE-98 combined with PR:N and C:H/I:H/A:H is consistent with an LFI that can escalate to RCE through log poisoning or inclusion of uploaded media, making this a meaningful priority for any site running this theme even though SSVC and EPSS data are missing from the available intelligence. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a Getaway theme endpoint, supplying a manipulated file parameter that traverses out of the intended template directory to load /etc/passwd, wp-config.php, or a poisoned access log. Reading wp-config.php exposes database credentials and WordPress auth keys, and if the attacker can write controlled content into any included file (uploads, logs, session files), the LFI converts to remote code execution as the PHP/web user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Local File Inclusion in the Getaway WordPress theme (versions before 1.8) by Select-Themes allows unauthenticated remote attackers to include arbitrary local PHP files via an unsanitized include/require parameter, leading to disclosure of sensitive files and potential code execution. The CWE-98 classification indicates improper control of filename used in PHP include/require, a pattern that frequently chains into RCE when log files, session files, or uploaded media can be referenced. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
RemediationAI
Patch available per vendor advisory: upgrade the Getaway WordPress theme to version 1.8 or later as published by Select-Themes and tracked by Patchstack at https://patchstack.com/database/wordpress/theme/getaway/vulnerability/wordpress-getaway-theme-1-8-local-file-inclusion-vulnerability. If immediate upgrade is not possible, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to block requests containing path traversal sequences such as '../', null bytes, and 'php://' or 'file://' wrappers targeting Getaway theme endpoints, and restrict PHP execution and read access on wp-content/uploads to prevent log-poisoning chains - with the trade-off that overly broad rules can break legitimate AJAX template loading. Also confirm allow_url_include is Off in php.ini (it should be by default) to limit the inclusion to local files only, and audit access logs for prior exploitation since fix release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the Getaway commercial WordPress theme distributed by Select-Themes (CPE cpe:2.3:a:select-themes:getaway). CWE-98 ('Improper Control of Filename for Include/Require Statement in PHP Program') is the classic PHP file-inclusion weakness: a user-controlled value is concatenated into an include(), require(), include_once(), or require_once() call without allowlisting or path normalization. In WordPress themes this typically appears in AJAX handlers, template loaders, or shortcode handlers that resolve a 'page', 'template', or 'file' parameter, and runs inside the WordPress PHP process with full filesystem permissions of the web user.
Know when Getaway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable WordPress theme endpoint, unauthenticated (PR:N), no user interaction, AC:H for required traversal/wrapper crafting; LFI yields file disclosure and likely RCE giving full C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Local File Inclusion in Getaway < 1.8 versions.
Executive ViewAI
The Getaway WordPress theme (versions before 1.8) contains a file inclusion vulnerability allowing unauthenticated external attackers to access sensitive files and potentially execute code. No public exploit identified at time of analysis, but organizations using this theme face immediate risk of data breach and operational compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB