EUVD-2026-37649Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Reprizo theme
-
DeliverySend crafted request with traversal payload to theme endpoint
-
ExploitPHP include() resolves attacker-controlled path
-
ExecutionRead wp-config.php or poison includable log
-
PersistEscalate to database access or PHP code execution
-
ImpactEstablish admin persistence on site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target WordPress site to have the AxiomThemes Reprizo theme version 1.0.8 or earlier installed and active (or at least loadable), and network reachability to the WordPress frontend so the vulnerable theme endpoint or parameter can be requested. No authentication and no user interaction are required (PR:N/UI:N). The CVSS AC:H rating indicates that successful exploitation depends on a non-trivial condition not detailed in the public Patchstack summary - likely a specific parameter, request method, encoding, or server configuration (such as allow_url_include for full RCE escalation, or writable log paths for log-poisoning chains) - meaning casual one-shot exploitation may not be reliable across all installations. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) describes a network-reachable, unauthenticated bug with full CIA impact but flagged with AC:H, implying some non-trivial condition (e.g., specific request shape, race, or environment) is needed for reliable exploitation. There is no CISA KEV listing and no EPSS score provided, and no public exploit identified at time of analysis, so the realistic risk is moderate rather than imminent - however, WordPress LFI vulnerabilities in popular themes have a strong history of being weaponized post-disclosure by mass-scanning botnets, so urgency should be treated as high for any internet-exposed site running this theme. The I:H and A:H ratings for a pure LFI deserve scrutiny: LFI typically yields C:H, while I:H/A:H usually presume log-poisoning, session-file inclusion, or include-to-RCE escalation paths, which is plausible but not explicitly confirmed in the Patchstack-sourced description. |
| Exploit ScenarioDerived | An unauthenticated attacker scanning WordPress sites identifies one running the Reprizo theme and issues a crafted HTTP GET or POST request to a vulnerable theme endpoint with a traversal payload such as ../../../../wp-config.php, retrieving database credentials and WordPress secret keys. With wp-config.php in hand, the attacker connects to the exposed database (or chains the LFI with log-poisoning of /var/log/apache2/access.log to achieve PHP code execution), establishing administrative control over the site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated local file inclusion in the Reprizo WordPress theme by AxiomThemes (versions 1.0.8 and earlier) allows remote attackers to coerce the PHP include/require chain into loading arbitrary server-side files, leading to disclosure of sensitive configuration data and potential code execution if uploaded or log files can be referenced. No public exploit identified at time of analysis, but the issue is tracked by Patchstack as a high-severity flaw against a commercial WordPress theme.
RemediationAI
Upgrade the Reprizo theme to a version newer than 1.0.8 once the vendor (AxiomThemes, distributed via ThemeForest and tracked by Patchstack at https://patchstack.com/database/wordpress/theme/reprizo/vulnerability/wordpress-reprizo-theme-1-0-8-local-file-inclusion-vulnerability) publishes a fixed release; the input data does not name an exact fixed version, so no vendor-released patch is independently confirmed at time of analysis. As compensating controls until a patch is verified, deploy a WAF rule (Patchstack, Wordfence, or ModSecurity) to block requests containing path-traversal sequences (../, ..%2f, php://, file://, encoded null bytes) against Reprizo theme endpoints, disable or remove the theme on sites that are not actively using it, and restrict PHP open_basedir and disable allow_url_include in php.ini to limit which files an inclusion can reach - note that aggressive WAF rules can break legitimate template handling and open_basedir can interfere with plugins that legitimately read outside the web root.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Reprizo is a commercial WordPress theme distributed by AxiomThemes (CPE cpe:2.3:a:axiomthemes:reprizo). The root cause is CWE-98, improper control of a filename used in a PHP include/require statement - a class of bug where user-controlled input flows into include(), require(), include_once(), or require_once() without adequate sanitization or allow-listing. In WordPress themes this typically manifests in a template-loader, AJAX endpoint, or shortcode handler that takes a 'file', 'template', 'path' or similar parameter from request input and passes it directly to a PHP file-inclusion primitive, allowing path traversal (../) or absolute paths to reach files outside the intended template directory.
Know when Reprizo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N/UI:N); AC:H reflects undisclosed non-trivial condition; LFI primarily yields file disclosure (C:H) with only incidental I/A impact absent confirmed RCE chain.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.
Executive ViewAI
The Reprizo WordPress theme (versions 1.0.8 and earlier) by AxiomThemes contains an unauthenticated file inclusion vulnerability allowing remote attackers to extract database credentials, API keys, and system configuration files, exposing any organization using this theme to immediate credential compromise. This creates risk of lateral movement into internal systems and potential regulatory violations if exposed data includes customer or regulated information. All affected websites require urgent remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deactivate theme immediately; (2) Deploy Web Application Firewall rules to block local file inclusion patterns (path traversal sequences, PHP wrappers); (3) Implement file system permission restrictions limiting web server read access to non-public directories; (4) Enable comprehensive logging and alerting on PHP include/require operations and suspicious file access patterns; (5) Conduct urgent log forensics to confirm whether vulnerability was exploited and what data may have been accessed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB